The vulnerability allows holders of manage‑ or admin‑scoped API keys or oma_ access tokens to alter the management password without supplying the current password. Attackers can therefore lock out the operator, take control of the dashboard login, or disable the login requirement entirely, effectively compromising administrative access.

The affected product is OmniRoute from cheaper‑inference. All releases from version 3.8.0 up to, but not including, 3.8.52 are vulnerable; the issue is resolved in 3.8.52 and later.

The CVSS score of 7 signifies a moderate‑to‑high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet anyone possessing the relevant API keys can exploit it trivially by sending a POST request to /api/settings/require-login—an attack vector that requires only authenticated but privileged API access, making exploitation straightforward for those with appropriate credentials.