Advisoriesby IbisLiteLLMGHSA-j37q-q7p9-vpwm
LiteLLM: SSO Debug Flow Has Improper Authentication
No fix yet
A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | <= 1.82.2 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2026-12795, PYSEC-2026-4071
More LiteLLM advisories
All LiteLLM
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec LoaderCVE-2026-12798no fix yetBerriAI litellm: UI User Enumeration leads to System-Wide Information DisclosureCVE-2026-12799no fix yetLiteLLM: improper authorizationCVE-2026-12797no fix yetBerriAI litellm: SSO Login Does Not Invalidate Previous UI Session TokensCVE-2026-12796no fix yetLiteLLM: MCP Proxy Has Improper AuthenticationCVE-2026-12773fixed in 1.84.0LiteLLM: Admin Key Handler Has Improper AuthorizationCVE-2026-12770no fix yet