Technical impact
OmniRoute 3.8.50 and earlier expose a missing authentication flaw that allows any network user to POST to /api/sync/tokens without credentials when the requireLogin feature is disabled. The endpoint returns a sync token that the attacker can immediately use in a subsequent GET request to /api/sync/bundle. This endpoint delivers decrypted provider credentials and plaintext API keys, resulting in a direct compromise of sensitive secrets. The weakness is a classic Authentication Bypass, captured by CWE-306, and the retained validity of the token even after re‑enabling requireLogin extends the window of exploitation.
Affected Systems
The vulnerability is confined to the cheaper‑inference OmniRoute product, affecting all releases from 3.8.50 through 3.8.51 inclusive. Any installation that has the requireLogin flag turned off is automatically vulnerable until the software is patched to version 3.8.52 or later, which reintroduces authentication checks for the sync token endpoint.
Risk and Exploitability
The CVSS score of 8.2 denotes high severity, and the lack of a KEV listing does not reduce its urgency. EPSS is not available, so no quantified exploitation probability is reported, but the flaw can be triggered from any network host that can reach the API. The attacker’s actions require only an unauthenticated HTTP request; the existence of tokens that persist after login is re‑enabled increases the potential for repeated credential extraction. The likely attack vector is a remote attacker submitting HTTP requests to the exposed API endpoints.
