CVE-2026-118984
Last modified
CVE-2026-118984 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely..
Description
OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-118984?
How severe is CVE-2026-118984?
How do I fix CVE-2026-118984?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11895The HT Mega Addons for Elementor – Elementor Widgets & Templ…6.4
- CVE-2026-118952A flaw was found in the Kroxylicious ACL authorizer. Its pre…6.5
- CVE-2026-118959A flaw was found in the required action provider mechanism o…5.4
- CVE-2026-11896The My Calendar – Accessible Event Manager plugin for WordPr…5.3
- CVE-2026-11897IBM WebSphere Application Server - Liberty 17.0.0.3 through …7.5
- CVE-2026-11898The White Label CMS plugin for WordPress is vulnerable to St…4.4
- CVE-2026-118986CallBackery versions before 0.62.0 for Perl allow session co…
- CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session c…
- CVE-2026-118988CallBackery versions before 0.60.1 for Perl let unauthentica…
- CVE-2026-118989WebToffee Product Import Export for WooCommerce 2.5.1 before…5.5
- CVE-2026-11899The PDF Builder for WooCommerce. Create invoices,packing sli…4.3
- CVE-2026-118990CallBackery versions before 0.62.0 for Perl leave a world-re…
Are you affected by CVE-2026-118984?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST