CVE-2026-93355: 
Chainguard vulnerability analysis and mitigation

CVE-2026-93355 is a weak authentication vulnerability in BerriAI's LiteLLM (an open-source LLM proxy) that enables privilege escalation via an unverified email-based fallback lookup in the JWT authentication flow. An attacker holding a valid JWT from the configured identity provider can authenticate as any existing user — including those with proxy_admin privileges — by presenting a token containing an unverified email address matching a victim's account, without the system verifying the email_verified claim. All versions of LiteLLM up to and including 1.102.1 (and git commits up to f4308bc124eebc783dfc51790ce8db27ed21ae00) are affected. The vulnerability was published on September 28, 2026, and carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.6 (High) (Red Hat Advisory, GitHub Advisory).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing) and CWE-1390 (Weak Authentication). During JWT-based authentication, LiteLLM implements an email-based fallback lookup to resolve user identity; however, it fails to verify the email_verified claim within the JWT before performing this lookup. An attacker who possesses any valid JWT issued by the configured identity provider (e.g., obtained via a free or self-registered account) can craft or present a token with an unverified email address that matches a target victim's account. Upon successful lookup, LiteLLM inherits the victim's stored role and — critically — permanently overwrites the victim's stored identity binding with the attacker's token, granting persistent unauthorized access. A technical write-up and PoC lab environment have been published publicly (Ox Security Blog, VulnCheck Advisory, GitHub PoC Lab).

Successful exploitation allows an authenticated attacker (holding any valid IdP JWT) to impersonate any existing LiteLLM user, escalate privileges to proxy_admin level, and gain persistent unauthorized access to administrative endpoints. This exposes sensitive API keys and user management functions, enabling the attacker to read, modify, or revoke API keys used to access downstream LLM services, manage other user accounts, and potentially pivot to systems or services relying on those API keys. The integrity impact is severe because the victim's stored identity binding is permanently overwritten, meaning the attacker retains access even after the original JWT expires (Red Hat Advisory, GitHub Advisory).

A PoC lab environment has been published on GitHub (GitHub PoC Lab), and the NVD SSVC assessment classifies exploitation status as "poc." The EPSS score is approximately 0.27% (18th percentile), indicating a currently low but non-negligible probability of exploitation in the wild within 30 days. No confirmed in-the-wild exploitation or threat actor attribution has been reported as of the time of writing. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to hold a valid JWT from the configured identity provider (low privilege precondition), but no user interaction or complex conditions are needed beyond that (GitHub Advisory, VulnCheck Advisory).

1. Reconnaissance: Identify a publicly accessible LiteLLM proxy instance running version ≤ 1.102.1. Confirm JWT-based authentication is configured with an external identity provider (e.g., Google, Azure AD, Okta).
2. Obtain a valid JWT: Register or use an existing account with the configured identity provider to obtain a valid JWT. The email address on this account does not need to be verified.
3. Identify target account: Determine the email address of a high-privilege victim account (e.g., a proxy_admin user) through enumeration of the LiteLLM user management API or other reconnaissance.
4. Craft/present the token: Present the valid JWT to LiteLLM's authentication endpoint. The JWT's email claim should match the victim's registered email address. Because LiteLLM does not check the email_verified claim, it performs an email-based fallback lookup and resolves the attacker's session to the victim's account.
5. Inherit victim's role: LiteLLM assigns the victim's role (including proxy_admin) to the attacker's session and permanently overwrites the victim's stored identity binding with the attacker's token.
6. Access administrative endpoints: Use the elevated session to access administrative endpoints — enumerate and exfiltrate API keys, manage users, modify configurations, or create new privileged accounts for persistent access (Ox Security Blog, VulnCheck Advisory).

• Logs: Authentication log entries showing a JWT login for a user whose email is associated with an existing high-privilege account, but originating from an unfamiliar identity provider subject (sub claim) or client IP; repeated authentication attempts with different JWTs resolving to the same victim email address.
• Logs: Unexpected changes to stored user identity bindings in LiteLLM's database (e.g., user_id or sub field updated for an existing account without an explicit admin action).
• Network: Unusual API calls to LiteLLM administrative endpoints (e.g., /user/list, /key/list, /key/generate) from sessions that recently authenticated via JWT with an unverified email.
• Application Behavior: A legitimate proxy_admin user reports being unable to authenticate or experiencing unexpected session behavior (indicative of their identity binding being overwritten).
• File System / Database: Unexpected new API keys created or existing keys accessed/deleted in the LiteLLM key management store shortly after a suspicious JWT authentication event (Ox Security Blog, Red Hat Advisory).

Update LiteLLM to a version beyond 1.102.1 (git commit beyond f4308bc124eebc783dfc51790ce8db27ed21ae00), which contains the fix for this vulnerability. As an interim workaround, enforce strict verification of the email_verified claim in the JWT authentication flow at the identity provider or reverse proxy level before requests reach LiteLLM. Restrict access to administrative endpoints and API key management to known, explicitly authorized IP ranges or authenticated sessions. Monitor authentication logs for anomalous JWT logins resolving to high-privilege accounts. Consider auditing all existing proxy_admin identity bindings for unexpected changes (Red Hat Advisory, Red Hat Bugzilla, VulnCheck Advisory).

The vulnerability received coverage from Ox Security, who published a detailed technical blog post titled "LiteLLM: An Ordinary Login Token Can Become Someone Else's Admin Account," which served as a primary reference for the disclosure (Ox Security Blog). VulnCheck published a dedicated advisory and was credited as the assigner (VulnCheck Advisory). Community discussion appeared on Reddit's r/SecOpsDaily and r/blueteamsec subreddits, and the vulnerability was highlighted in The Hacker News weekly recap and ThreatAft's week-in-review for September 29–October 5, 2026. OpenSUSE also issued a security announcement referencing the CVE.