OmniRoute CVE-2026-116634

The instance must be running with requireLogin disabled (requireLogin=false, "open mode"). Under that mode only, an unauthenticated caller can POST /api/sync/tokens to mint a sync token (recorded as issuedBy:"open") and then call GET /api/sync/bundle with it to retrieve decrypted provider credentials and plaintext API keys - the same material /api/settings/export-json already refused to anonymous callers. Limiting factor confirmed by the diff: when login is required (the default login-enabled mode), /api/sync/tokens already demanded a dashboard session or the local CLI, so the flaw does not apply there. Additional exposure: tokens issued in open mode persisted and kept opening the bundle even after login was re-enabled, until the 3.8.52 fix invalidates all issuedBy:"open" tokens (operators must re-issue from the dashboard or CLI).

Signals are moderately strong but conditional. The vendor CVSS 4.0 score is 8.2 (High) with a confidentiality-only profile (VC:H, VI:N, VA:N) and the vector carries AT:P (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N), meaning exploitation depends on an attacker-uncontrolled precondition - here, the instance running with requireLogin disabled. No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no public-scale exploitation signal; exploitation status is 'no public exploit identified at time of analysis' (the references are patch commits, source lines and the VulnCheck advisory, not a working exploit). The vuln.today Decision label is 'this_week', consistent with a serious credential-disclosure bug that is gated behind a specific deployment mode rather than an emergency against default configs. Net: a genuine high-impact issue (full disclosure of decrypted provider credentials and plaintext API keys, with tokens that survive re-enabling login) that is a real priority for any instance deliberately run in open mode, but not a broad internet-wide emergency given the requireLogin=false precondition and the product's niche footprint. Missing data to note explicitly: EPSS is absent and no KEV entry exists, so widespread-exploitation likelihood cannot be quantified from the input.

An attacker able to reach an OmniRoute 3.8.50/3.8.51 instance configured with requireLogin disabled sends an unauthenticated POST to /api/sync/tokens to mint a sync token, then presents that token to GET /api/sync/bundle to download the decrypted provider credentials and plaintext API keys. No public exploit is identified, though the CVE references point to the exact unguarded route. The minted token (issuedBy "open") also keeps working even after login is turned back on, extending the exposure window.