Is there a public PoC exploit available for CVE-2026-12795?

Yes, a public proof-of-concept exploit is available for CVE-2026-12795. Prioritise patching immediately. EPSS: 0.4%.

LiteLLM CVE-2026-12795

Q: What is the CVSS score of CVE-2026-12795?

CVE-2026-12795 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38154 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-21 VulDB

GHSA-j37q-q7p9-vpwm

Authentication Bypass Red Hat Litellm Berriai

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable SSO debug endpoint requires no privileges; confidentiality and integrity are Low due to debug data exposure, with no credible availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:32 vuln.today

CVSS changed

Jun 21, 2026 - 09:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on litellm (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.82.2.

DescriptionCVE.org

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

AnalysisAI

Missing authentication in LiteLLM's SSO Debug Flow exposes the json.dumps output of the ui_sso.py management endpoint to unauthenticated remote attackers, enabling authentication bypass against versions up to 1.82.2. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this is network-exploitable with no privileges or user interaction required. A public proof-of-concept has been disclosed on GitHub, elevating practical risk beyond the moderate base score alone; no active exploitation has been confirmed by CISA KEV at the time of analysis.

Technical ContextAI

LiteLLM (CPE: cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source LLM proxy and gateway developed by BerriAI, used to route requests across multiple large language model providers. The vulnerable component is the SSO (Single Sign-On) debug flow implemented in litellm/proxy/management_endpoints/ui_sso.py. The root cause is CWE-306 (Missing Authentication for Critical Function): the json.dumps serialization call within this debug code path executes and returns sensitive SSO-related data without enforcing authentication checks. Debug endpoints in proxy management interfaces commonly carry elevated risk because they are designed to expose internal state for troubleshooting, making the absence of an authentication gate particularly impactful. The CVSS 4.0 E:P modifier confirms the exploit has been publicly demonstrated.

RemediationAI

No vendor-released patch version has been independently confirmed in the available intelligence at time of analysis; the NVD entry and VulDB advisory should be monitored for an updated fixed release. Operators running LiteLLM 1.82.0 through 1.82.2 should immediately assess whether management endpoints, particularly the SSO debug path in ui_sso.py, are exposed to untrusted networks. As a compensating control, restrict network access to the LiteLLM proxy management API (typically port 4000 or as configured) to trusted administrative hosts only using firewall rules or an API gateway, accepting the trade-off that legitimate remote administration will require VPN or bastion access. Disabling SSO debug functionality via environment configuration or by removing or guarding the relevant route, if the application supports it, would directly eliminate the vulnerable code path. The public exploit is documented at https://gist.github.com/YLChen-007/9b13c75a3a73187a4082cc6df0b100d3 and should be reviewed to understand the precise endpoint and parameters involved before deploying workarounds.