Is there a public PoC exploit available for CVE-2026-12796?

Yes, a public proof-of-concept exploit is available for CVE-2026-12796. Prioritise patching immediately. EPSS: 0.3%.

LiteLLM CVE-2026-12796

Q: What is the CVSS score of CVE-2026-12796?

CVE-2026-12796 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38155 LOW

Insufficient Session Expiration (CWE-613)

2026-06-21 VulDB

GHSA-w2mh-qq9q-453x

Information Disclosure Litellm Berriai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Low-privilege SSO session required (PR:L); impact limited to session persistence enabling minor unauthorized data access and action (C:L/I:L); no availability impact from expiration bypass.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:32 vuln.today

Severity Changed

Jun 21, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 10:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on litellm (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.82.2.

DescriptionCVE.org

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

AnalysisAI

Insufficient session expiration in LiteLLM's SSO authentication flow exposes deployments running versions 1.82.0 through 1.82.2 to unauthorized persistent session access by low-privileged authenticated users. The flaw resides in the get_redirect_response_from_openid function within the OpenID Connect callback handling code, allowing manipulation of the SSO redirect response to bypass session lifetime enforcement. No confirmed active exploitation (not in CISA KEV), but a publicly available proof-of-concept exploit on GitHub lowers the barrier to abuse, and the CVSS 4.0 vector explicitly encodes the exploit availability modifier E:P.

Technical ContextAI

The vulnerability is rooted in CWE-613 (Insufficient Session Expiration), a class of flaw where an application fails to properly invalidate or enforce expiration on session tokens at the conclusion of an authentication cycle, logout, or token revocation event. Specifically, the affected code is litellm/proxy/management_endpoints/ui_sso.py, function get_redirect_response_from_openid, which handles the OpenID Connect (OIDC) redirect callback - the final leg of the SSO handshake where an authorization code is exchanged for session credentials. In OIDC flows, this phase is responsible for establishing and validating session state; a CWE-613 flaw here typically manifests as the application accepting stale, replayed, or previously-issued redirect tokens whose expiration is not enforced, allowing an attacker to sustain a valid session beyond its authorized window. The affected CPE is cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*, covering all LiteLLM variants up to 1.82.2. The VulDB tag 'Information Disclosure' aligns with the consequence of unauthorized continued access to session-scoped data.

RemediationAI

No vendor-released patch with a confirmed exact fix version has been identified in the available data - the fix status from BerriAI is unknown at time of analysis. Organizations should monitor the BerriAI/litellm GitHub repository and VulDB advisory at https://vuldb.com/vuln/372558 for a patched release. As an interim compensating control, restrict network access to the LiteLLM proxy's SSO endpoints (specifically the /ui/sso callback path) to trusted internal networks or VPN-only access, reducing the network-reachable attack surface. Implementing short absolute session timeouts at the reverse proxy layer (e.g., via nginx proxy_read_timeout combined with session cookie Max-Age enforcement) can limit the window during which an expired session remains exploitable. If SSO is not strictly required, disabling the OpenID Connect SSO feature entirely eliminates the vulnerable code path - note this trades off federated authentication convenience for risk reduction. Review server-side session invalidation logic on logout as an architectural follow-up.