cheaper-inference CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH cheaper-inference CVE published 2026-10-26

CVE-2026-116634

CVE-2026-116634 is a high-severity vulnerability in OmniRoute versions 3.8.50 before 3.8.52. The vulnerability allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. These tokens can be used against GET /api/sync/bundle to retrieve decrypted provider credentials and plaintext API keys. The tokens persist even after login is re-enabled.