Loading story…
A high-severity authentication flaw, CVE-2026-93355, in LiteLLM's JWT identity-resolution flow can let an attacker impersonate an existing user by presenting a valid token from the configured identity provider with the victim's email address. When subject-based matching fails, affected versions perform a case-insensitive email fallback without verifying the email_verified claim. An attacker targeting a proxy_admin account could access administrative endpoints, user and key records, and upstream LLM-provider API keys managed by the LiteLLM proxy.
The fallback can also overwrite the victim's stored sso_user_id with the attacker's JWT subject, turning the initial impersonation into persistent access. LiteLLM versions through 1.102.1 are affected, with 1.102.2 and later fixing the issue; public reporting found no known active exploitation or CISA KEV listing. Organizations should upgrade immediately, investigate identity-binding changes, rotate exposed virtual and provider API keys, and reject JWTs that lack verified email claims until remediation is complete.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
After approximately 120 days without a reported vendor response, OX Research publicly disclosed the LiteLLM authentication-bypass issue. The attack can impersonate a matched user and persistently rebind the victim account's SSO identity to an attacker-controlled JWT subject.
LiteLLM version 1.100.1 was published and was reported to remain vulnerable to the JWT email-fallback authentication bypass.
OX Research sent LiteLLM a follow-up concerning CVE-2026-93355 and reported receiving no vendor response.
OX Research reported the JWT identity-resolution vulnerability later designated CVE-2026-93355 to LiteLLM. The issue allows an unverified email claim from a trusted identity provider to match an existing account and impersonate that user.
LiteLLM version 1.102.2 and later were identified as fixing CVE-2026-93355, which affects versions through 1.102.1. The fix addresses fallback email identity matching without validation of the JWT email_verified claim.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LiteLLM fixed two high-severity vulnerabilities in version `1.83.0` that could allow attackers to gain elevated access in AI gateway deployments. **CVE-2026-35029** stems from missing admin authorization on the `/config/update` endpoint, allowing an authenticated low-privilege user to change proxy settings and environment variables. The flaw could be abused to register attacker-controlled Python handlers for remote code execution, read arbitrary server files, and overwrite UI credentials to seize privileged accounts, creating broad confidentiality, integrity, and availability risk. The same release also addressed **CVE-2026-35030**, an authentication bypass affecting LiteLLM deployments that enabled JWT-based authentication. In vulnerable versions, the platform used the first 20 characters of a token as the OIDC userinfo cache key, allowing a crafted token with a matching prefix to collide with a legitimate cached session and inherit that user’s identity and permissions. The issue is not enabled by default, limiting exposure to specific configurations, but together the flaws highlight significant access-control weaknesses in LiteLLM versions prior to `1.83.0`.
Jun 29, 2026
A critical vulnerability in **LiteLLM** tracked as `CVE-2026-49468` allows attackers to bypass authentication through **Host header injection** and reach protected management endpoints. The flaw affects LiteLLM versions earlier than **`1.84.0`** and stems from a mismatch in how the authentication layer evaluates routes versus how **FastAPI** ultimately dispatches them, creating a path for unauthenticated access under specific conditions. The issue is classified as **`CWE-290`** and has been rated **CVSS 9.5**, with researchers describing it as network-exploitable with low attack complexity and no user interaction required. The vulnerability was responsibly disclosed by **Le The Thang** of **KCSC** and **Kim Ngoc Chung** of **One Mount Group**, and LiteLLM maintainers have released a fix in version **`1.84.0`** with no configuration changes required. There is no confirmed evidence of active exploitation, and **LiteLLM Cloud** customers are reportedly not affected. Self-hosted deployments may also be shielded if upstream infrastructure such as **Cloudflare**, **WAFs**, reverse proxies with strict allowlists, or host-validating load balancers normalize or reject malformed Host headers before requests reach the application.
Jun 29, 2026
Wiz researchers found that **294 of 3,074** internet-facing LiteLLM gateways accepted the documented default administrator key, `sk-1234`, while **191** had no master-key authentication configured. An attacker with master-key access can retrieve model-provider API keys, inspect prompts and responses, access MCP-connected tools, and abuse unrestricted pass-through endpoints to query cloud instance metadata services and obtain IAM credentials. The exposure coincides with multiple LiteLLM flaws, including actively exploited MCP authentication bypass **CVE-2026-59822**, which allows arbitrary Bearer tokens to create authenticated MCP sessions, and Python code execution **CVE-2026-59821** through custom code guardrails in versions before 1.82.0. Organizations should upgrade to LiteLLM **1.84.0 or later**, replace and rotate default master keys, remove public access to management and MCP endpoints, restrict container egress, and enforce least-privilege cloud IAM permissions.
Sep 11, 2026