LiteLLM: Authentication bypass via OIDC userinfo cache key collision
CriticalCVE-2026-35030 · Published Apr 3, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| litellm PyPI | < 1.83.0 | 1.83.0 |
Details and references
### Impact When JWT authentication is enabled (`enable_jwt_auth: true`), the OIDC userinfo cache uses `token[:20]` as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. **Most instances are not affected.** An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled. ### Patches Fixed in v1.83.0. The cache key now uses the full hash of the JWT token. ### Workarounds Disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-287
- Also known as
- CVE-2026-35030, PYSEC-2026-390
More LiteLLM advisories
All LiteLLM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 3 | LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint CVE-2026-35029Highfixed in 1.83.0 | High | 1.83.0 |
| Apr 8 | LiteLLM: Password hash exposure and pass-the-hash authentication bypass GHSA-69x8-hrgq-fjj8Highfixed in 1.83.0 | High | 1.83.0 |
| Mar 25 | Two LiteLLM versions published containing credential harvesting malware GHSA-5mg7-485q-xm76Criticalno fix yet | Critical | No fix yet |
| Mar 24 | Two litellm versions published containing credential harvesting malware PYSEC-2026-2Unratedno fix yet | Unrated | No fix yet |
| Mar 24 | Malicious code in litellm (PyPI) MAL-2026-2144Unratedno fix yet | Unrated | No fix yet |
| Apr 24 | LiteLLM: Server-Side Template Injection in /prompts/test endpoint CVE-2026-42203Highfixed in 1.83.7 | High | 1.83.7 |