Executive brief
LiteLLM is a popular library that manages API keys and routes requests to various large language models. The SSO (Single Sign-On) debug endpoints in LiteLLM lack proper authentication controls, allowing an attacker to access sensitive OAuth user profile data—including email addresses, display names, team identifiers, and in some cases raw OAuth tokens—without presenting valid credentials. Additionally, the vulnerable code injects user-controlled data into JavaScript without proper escaping, enabling reflected cross-site scripting (XSS) attacks that could steal administrator session cookies.
Technical details
The vulnerability exists in two unauthenticated debug endpoints (GET /sso/debug/login and GET /sso/debug/callback) within litellm/proxy/management_endpoints/ui_sso.py. Unlike other management endpoints that require Depends(user_api_key_auth), these debug endpoints lack authentication checks and rely only on an enterprise license check on /sso/debug/login, which validates the server's license not the caller's identity. The /sso/debug/callback endpoint has no protection whatsoever. For Google and Microsoft SSO configurations, the debug flow explicitly requests raw OAuth responses (via return_raw_sso_response=True) that bypass a recently added _OAUTH_TOKEN_FIELDS allowlist filter, exposing raw access_token and id_token values. The callback endpoint renders filtered OAuth data into an HTML <script> block using json.dumps() without HTML escaping; json.dumps() does not escape </script> sequences, allowing a reflected XSS vector if an attacker controls their OAuth profile fields (e.g., display_name). An unauthenticated network attacker can trigger the SSO debug flow to obtain user profiles and tokens, and craft specially formatted profile fields to execute arbitrary JavaScript. The exploit has been publicly disclosed. As of the advisory publication (June 2026), no patched version is listed.
Affected products
- BerriAI litellm <= 1.82.2
Timeline
- 2026-06-21: disclosed: Public disclosure via GHSA and GitHub advisory
- 2026-06-21: advisory: CVE-2026-12795 published; GHSA-j37q-q7p9-vpwm published