CVE-2026-12795: BerriAI LiteLLM missing authentication in SSO debug endpoints

CVE-2026-12795 · Severity: high · CVSS 7.3 · Published 2026-06-21

LiteLLM is a popular library that manages API keys and routes requests to various large language models. The SSO (Single Sign-On) debug endpoints in LiteLLM lack proper authentication controls, allowing an attacker to access sensitive OAuth user profile data—including email addresses, display names, team identifiers, and in some cases raw OAuth tokens—without presenting valid credentials. Additionally, the vulnerable code injects user-controlled data into JavaScript without proper escaping, enabling reflected cross-site scripting (XSS) attacks that could steal administrator session cookies.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12795 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12795 being exploited in the wild.
How severe is CVE-2026-12795?
High severity, with a CVSS score of 7.3, published 21 June 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.82.2; litellm (PyPI) ECOSYSTEM:introduced=0,last_affected=1.82.2.
Is there a fix for CVE-2026-12795?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12795 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12795?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in two unauthenticated debug endpoints (GET /sso/debug/login and GET /sso/debug/callback) within litellm/proxy/management_endpoints/ui_sso.py. Unlike other management endpoints that require Depends(user_api_key_auth), these debug endpoints lack authentication checks and rely only on an enterprise license check on /sso/debug/login, which validates the server's license not the caller's identity. The /sso/debug/callback endpoint has no protection whatsoever. For Google and Microsoft SSO configurations, the debug flow explicitly requests raw OAuth responses (via return_raw_sso_response=True) that bypass a recently added _OAUTH_TOKEN_FIELDS allowlist filter, exposing raw access_token and id_token values. The callback endpoint renders filtered OAuth data into an HTML &lt;script&gt; block using json.dumps() without HTML escaping; json.dumps() does not escape &lt;/script&gt; sequences, allowing a reflected XSS vector if an attacker controls their OAuth profile fields (e.g., display_name). An unauthenticated network attacker can trigger the SSO debug flow to obtain user profiles and tokens, and craft specially formatted profile fields to execute arbitrary JavaScript. The exploit has been publicly disclosed. As of the advisory publication (June 2026), no patched version is listed.

Affected products

  • BerriAI litellm <= 1.82.2

Identifiers

  • CVE-2026-12795
  • GHSA-j37q-q7p9-vpwm
  • PYSEC-2026-4071

Timeline

  • 2026-06-21: disclosed: Public disclosure via GHSA and GitHub advisory
  • 2026-06-21: advisory: CVE-2026-12795 published; GHSA-j37q-q7p9-vpwm published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.