CVE-2026-12796: litellm SSO Session Expiration Vulnerability (CVSS 6.3)

Technical summary

CVE-2026-12796 exists in the SSO authentication flow component of litellm's proxy management endpoints, specifically within the get_redirect_response_from_openid function in litellm/proxy/management_endpoints/ui_sso.py. The vulnerability allows manipulation of OpenID redirect responses, resulting in unauthorized session expiration. The flaw stems from improper session state validation (CWE-613: Insufficient Session Expiration) and is exploitable by any authenticated user without requiring user interaction or special system privileges. The attack surface is remote, making it actionable from network-accessible deployments.

Business impact

Session expiration attacks disrupt service availability for legitimate users and can create a vector for account takeover when combined with phishing or credential compromise. Organizations using litellm as an API gateway or authentication proxy may experience degraded user experience, forced re-authentication loops, and potential denial of service if exploit activity targets multiple concurrent sessions. The impact is especially acute in multi-tenant environments where users share the same SSO endpoint.

Affected systems

BerriAI litellm versions up to and including 1.82.2 are confirmed vulnerable. Organizations should verify their deployment version immediately. The vulnerability affects deployments that enable SSO authentication via the proxy management endpoints; non-SSO configurations or isolated offline deployments face lower risk. Check your litellm version with 'pip show litellm' or equivalent package manager query.

Exploitability

The vulnerability is remotely exploitable with low complexity and low attack overhead—only valid user authentication is required. Public exploit code availability increases the likelihood of opportunistic attacks, though the requirement for authenticated access limits blast radius compared to unauthenticated flaws. Attack speed is fast once credentials are obtained, making detection and response velocity critical.

Remediation

Upgrade litellm to a patched version released after the June 24, 2026 modification date. Verify the patch version with the BerriAI project maintainers or official release notes. Interim mitigations include restricting SSO proxy access to trusted networks, monitoring session logs for anomalous expiration patterns, and implementing rate limiting on authentication endpoints to slow exploitation attempts.

Patch guidance

Check the BerriAI litellm repository (GitHub: BerriAI/litellm) for releases newer than 1.82.2. Upgrade using 'pip install --upgrade litellm' and verify the installed version post-deployment. Test SSO functionality in a staging environment before production rollout. If patch availability is delayed, consult the vendor's security advisory for temporary workarounds or configuration hardening steps.

Detection guidance

Monitor authentication logs for unusual session termination patterns, particularly clusters of expiration events from the same user or IP within short timeframes. Search proxy logs for repeated requests to the /sso or OpenID redirect endpoints with subsequent 401/403 responses. Implement alerting on session_expired events correlated with OpenID callback processing. Review litellm proxy access logs for evidence of the get_redirect_response_from_openid function being called with malformed or unexpected parameters.

Why prioritize this

CVSS 6.3 (MEDIUM) reflects confidentiality, integrity, and availability impact with low attack complexity, but the requirement for prior authentication prevents critical severity. However, public exploit availability and the focus on session integrity—a core security control—warrant priority patching. Organizations running production SSO proxies should patch within 30 days; those with internet-exposed litellm instances should treat it as urgent.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) assigns MEDIUM severity because the attack is network-accessible with no user interaction, but it mandates low-privileged authentication. The flaw impacts three security dimensions (confidentiality, integrity, availability) at low severity each—typical of session-layer attacks—yielding a 6.3 base score. The presence of public exploits increases operational risk above the baseline CVSS, and the lack of KEV designation suggests no current mass-exploitation reports.

Frequently asked questions