Logo
Retour à la veille

CVE-2026-116634

Publié : 26 octobre 2026
Modifié : 26 octobre 2026
Lien officiel NVD
Score CVSS
5.9
MEDIUM

Description détaillée

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys, with tokens persisting after login is re-enabled.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/cheaper-inference/OmniRoutehttps://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/app/api/sync/tokens/route.ts#L28-L30https://github.com/cheaper-inference/OmniRoute/blob/c1e30b7676975feb298b49eff6ff58923c04b89e/src/server/authz/routeGuard.ts#L154-L167https://github.com/cheaper-inference/OmniRoute/commit/44a29611bf088e351d8d40eacaabdc1794ed0c61https://github.com/cheaper-inference/OmniRoute/pull/17053https://github.com/cheaper-inference/OmniRoute/releases/tag/v3.8.52https://www.vulncheck.com/advisories/omniroute-3.8.50-before-3.8.52-missing-authentication-via-api-sync-tokens

Dernières Vulnérabilités

CVE-2026-116638

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.

VOIR DÉTAILS

CVE-2026-116632

A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.

VOIR DÉTAILS

CVE-2026-116631

A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.

VOIR DÉTAILS