CVE-2026-12795: Authentication Bypass in BerriAI litellm SSO Debug Flow (CVSS 7.3)

Technical summary

The vulnerability resides in the SSO debug flow component (litellm/proxy/management_endpoints/ui_sso.py), specifically in how the json.dumps function processes SSO-related data without proper authentication validation. By exploiting inadequate input handling in the debug flow, an attacker can craft requests that bypass the intended authentication mechanism (CWE-287: Improper Authentication and CWE-306: Missing Authentication for Critical Function). The flaw allows remote exploitation with no special privileges or user interaction required, making it a network-accessible authentication bypass.

Business impact

Organizations deploying litellm as an API gateway or proxy layer face direct risk of unauthorized access to backend LLM services and potentially sensitive data processed by those models. This is particularly critical for enterprises using litellm to manage multi-tenant API access, as an attacker could impersonate legitimate users or bypass rate-limiting and billing controls. The public disclosure of exploit code elevates urgency, as malicious actors have functional attack paths ready for deployment. Affected systems should be treated as potentially compromised until patching is verified.

Affected systems

BerriAI litellm versions up to 1.82.2 are vulnerable. This includes any deployment where the SSO debug flow is enabled or accessible. Users running litellm as a reverse proxy, API gateway, or authentication layer for LLM backends are at highest risk. Verify your installed version immediately; the vendor was contacted early and patches are likely available or imminent.

Exploitability

Exploitation is straightforward and requires no authentication, special privileges, or user interaction. An attacker needs only network access to the litellm proxy endpoint and knowledge of the SSO debug flow endpoint structure. The attack can be executed remotely over HTTP/HTTPS. With public disclosure and likely-available proof-of-concept code, the exploitability window is active now. This is not a theoretical or difficult-to-exploit flaw.

Remediation

Upgrade litellm to a patched version beyond 1.82.2 immediately. Verify the specific patch version in the official BerriAI GitHub releases and security advisories. As an interim measure, if patching cannot be deployed immediately, restrict network access to the litellm proxy to trusted IP ranges only, disable or remove the SSO debug flow if it is not operationally necessary, and monitor authentication logs for anomalous access patterns or failed credential validation.

Patch guidance

Check the BerriAI litellm GitHub repository and official security advisories for the latest patched version. The vendor was contacted early, so a fix is likely available. Apply updates through your standard deployment pipeline (pip, Docker, etc.). After patching, restart all litellm instances and verify that the SSO authentication flow enforces proper credential validation. Test from both authorized and unauthorized contexts to confirm the fix is effective. Do not skip this step given the public exploit disclosure.

Detection guidance

Monitor litellm proxy logs for requests to SSO debug endpoints (/debug, /sso, or similar paths depending on your configuration) that originate from unexpected sources or that bypass normal authentication flows. Look for json.dumps-related errors or unusual serialization patterns in debug logs. Implement Web Application Firewall (WAF) rules to block or alert on requests to debug endpoints from external networks. Check for authentication logs showing successful access without corresponding valid credential presentation. Intrusion detection systems should flag HTTP requests to sensitive proxy paths from unauthenticated sources.

Why prioritize this

This vulnerability combines high CVSS score (7.3), network exploitability, public disclosure, and direct impact on authentication—a core security control. Any system using litellm for API gateway or multi-tenant LLM access should treat this as critical. The lack of KEV designation does not diminish urgency; public exploit code is available, making active exploitation likely in the wild. Prioritize patching within 24–48 hours for internet-facing deployments.

Risk score, explained

CVSS 7.3 (HIGH) reflects the confluence of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The score appropriately captures an authentication bypass that allows unauthorized access with moderate impact. Contextually, the public disclosure and immediate exploitability elevate real-world risk beyond the numerical score alone.

Frequently asked questions