CVE-2026-118984

The record

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma_ access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock out the operator, take over dashboard login, or disable the login requirement entirely.

Affected packages

Related vulnerabilities

• CVE-2026-119429 phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows… CWE-620
• CVE-2013-20008 Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows… CWE-620
• CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
• CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
• CVE-2026-77644 A critical bypass access control vulnerability has been reported in PTC Windchill Risk… CWE-620
• CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
• CVE-2026-17599 Nexus Repository 3 contained an endpoint used to change the administrator account… CWE-620
• CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. CWE-620