Executive brief
LiteLLM is an API gateway used to manage and route requests to language model services with single sign-on (SSO) authentication support. When users log in via SSO, the system generates new session tokens but fails to invalidate previously issued tokens for the same user. An attacker who obtains any valid session token can retain access to a user's account indefinitely, even after the victim re-authenticates, and tokens accumulate in the database with each login attempt.
Technical details
This is an insufficient session expiration vulnerability (CWE-613) in the SSO authentication handler of litellm/proxy/management_endpoints/ui_sso.py, specifically in the get_redirect_response_from_openid method. When a user authenticates via SSO (Google, Okta, or Generic OAuth), the function generates a new API key in the LiteLLM_VerificationToken table but never deletes or expires previously issued keys for that user_id. This allows unbounded token accumulation: all historical tokens remain independently valid with default 24-hour absolute expiration, enabling a remote authenticated attacker to retain persistent unauthorized access even after the victim re-authenticates. The vulnerability requires the attacker to have previously compromised a session token (e.g., via XSS, log exposure, or network interception) but does not require user interaction or administrative privileges to exploit. A proof-of-concept demonstrates that multiple tokens for the same user coexist and remain functional in the database after SSO re-login. No patch has been released as of the advisory date.
Affected products
- BerriAI litellm <= 1.82.2
Timeline
- 2026-06-21: disclosed: Published to GitHub Advisory Database
- 2026-06-21: advisory
- 2026-03-21: other: Original disclosure/PoC published on GitHub Gist