GitHub Advisoryadvisory · PyPI

GHSA-w2mh-qq9q-453x BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens

LOW Published 2026-06-21 Modified 2026-09-14 Official page ↗
Aliases
CVE-2026-12796
Ecosystem
PyPI
Packages
litellm
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-613
Reviewed
2026-09-14

Affected packages

• PyPI litellm: <= 1.82.2 (no fix yet)

Description

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2026-12796 A vulnerability was identified in BerriAI litellm up to 1.82.2. vulnerability

References