LiteLLM EUVD-2026-38154

Exploitation requires that the LiteLLM proxy SSO feature is configured and in use, as the vulnerability is confined to the SSO Debug Flow code path in ui_sso.py. The CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L) confirms no authentication, no user interaction, and no special local access is needed - exploitation is possible from any network-reachable position against the management endpoint. The primary limiting factor is network exposure: if the LiteLLM management API is bound to localhost or restricted by a firewall to trusted administrative subnets, remote exploitation is blocked without those access controls being defeated first. Deployments that do not use SSO (e.g., API-key-only configurations) are not expected to exercise the vulnerable code path, though this has not been confirmed by vendor statement in available data.

The CVSS 4.0 score of 5.5 (Medium) reflects network-reachable, zero-privilege, zero-interaction exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), but limits impact to Low across all three CIA dimensions on the vulnerable system (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N). The E:P exploit maturity modifier confirms a public POC exists, meaningfully increasing real-world exploitation likelihood beyond a raw numeric score would suggest. There is no CISA KEV listing, so confirmed active exploitation is not established. EPSS data was not provided in the intelligence feed, leaving exploitation probability quantification incomplete. The combination of PR:N network access, low complexity, and a publicly available exploit script elevates this beyond a typical medium-severity finding for any LiteLLM deployment with SSO enabled and management endpoints exposed to untrusted networks. The low CIA impact ratings suggest the immediate blast radius is constrained - likely limited to information disclosure of SSO debug state and potential session or flow manipulation - rather than full system compromise, but authentication bypass in an identity-adjacent component can serve as a stepping stone in a broader attack chain.

An unauthenticated remote attacker identifies a LiteLLM proxy instance with management endpoints reachable over the network and SSO configured. Using the publicly available POC from GitHub, the attacker sends a crafted HTTP request to the SSO debug endpoint in ui_sso.py, bypassing the absent authentication gate and receiving a JSON-serialized dump of SSO state - potentially including tokens, session data, or identity provider configuration. This information can then be used to impersonate authenticated users or pivot into connected identity systems.