CVE-2026-12796: BerriAI LiteLLM insufficient session expiration in SSO flow

CVE-2026-12796 · Severity: medium · CVSS 6.3 · Published 2026-06-21

LiteLLM is an API gateway used to manage and route requests to language model services with single sign-on (SSO) authentication support. When users log in via SSO, the system generates new session tokens but fails to invalidate previously issued tokens for the same user. An attacker who obtains any valid session token can retain access to a user's account indefinitely, even after the victim re-authenticates, and tokens accumulate in the database with each login attempt.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12796 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12796 being exploited in the wild.
How severe is CVE-2026-12796?
Medium severity, with a CVSS score of 6.3, published 21 June 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.82.2; litellm (PyPI) ECOSYSTEM:introduced=0,last_affected=1.82.2.
Is there a fix for CVE-2026-12796?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12796 attacked?
It is attacked over the network.
Am I affected by CVE-2026-12796?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an insufficient session expiration vulnerability (CWE-613) in the SSO authentication handler of litellm/proxy/management_endpoints/ui_sso.py, specifically in the get_redirect_response_from_openid method. When a user authenticates via SSO (Google, Okta, or Generic OAuth), the function generates a new API key in the LiteLLM_VerificationToken table but never deletes or expires previously issued keys for that user_id. This allows unbounded token accumulation: all historical tokens remain independently valid with default 24-hour absolute expiration, enabling a remote authenticated attacker to retain persistent unauthorized access even after the victim re-authenticates. The vulnerability requires the attacker to have previously compromised a session token (e.g., via XSS, log exposure, or network interception) but does not require user interaction or administrative privileges to exploit. A proof-of-concept demonstrates that multiple tokens for the same user coexist and remain functional in the database after SSO re-login. No patch has been released as of the advisory date.

Affected products

  • BerriAI litellm <= 1.82.2

Identifiers

  • CVE-2026-12796
  • GHSA-w2mh-qq9q-453x
  • PYSEC-2026-4076

Timeline

  • 2026-06-21: disclosed: Published to GitHub Advisory Database
  • 2026-06-21: advisory
  • 2026-03-21: other: Original disclosure/PoC published on GitHub Gist

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.