Vulnerability details

CVE-2026-93355

BerriAI litellm

LiteLLM Weak JWT Authentication via Email-Based User Lookup

CVSS 4.0

7.6High

Official description

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim's account to inherit the victim's role, including proxy_admin privileges, and permanently overwrite the victim's stored identity binding to retain persistent unauthorized access to administrative endpoints exposing API keys and user management.

CVSS scores

Score	Version	Source	Vector
7.6High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Affected products

Vendor	Product	Versions	Source
BerriAI	litellm	v ≤ 1.102.1	CVEProject cvelistV5 (CNA)
BerriAI	litellm	v ≤ f4308bc124eebc783dfc51790ce8db27ed21ae00	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ox.security/blog/litellm-an-ordinary-login-token-can-become-someone-elses-admin-account/ technical-descriptionexploit
https://www.vulncheck.com/advisories/litellm-weak-jwt-authentication-via-email-based-user-lookup third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-28
Last updated: 2026-10-01
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.27%

Probability of exploitation in 30 days

19.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-1390
Weak Authentication