JWT Authentication Vulnerability in LiteLLM Proxy Server by BerriAI

CVE-2026-35030

What is CVE-2026-35030?

The vulnerability in LiteLLM arises when JWT authentication is enabled, specifically in versions prior to 1.83.0. The application utilizes the first 20 characters of the JWT token as the cache key for OIDC userinfo. Because JWT headers created by the same signing algorithm produce identical initial characters, an attacker can forge a token that matches a legitimate user's cached key. This allows them to gain unauthorized access to the user's identity and permissions if the cache hit occurs. This flaw primarily impacts systems configured with JWT/OIDC authentication enabled. The issue has been addressed in version 1.83.0.

References