LiteLLM EUVD-2026-38155

Exploitation strictly requires a valid low-privilege authenticated session against the LiteLLM proxy - the CVSS 4.0 vector explicitly encodes PR:L, confirming authentication is mandatory and unauthenticated exploitation is not possible. The critical deployment condition is that SSO via OpenID Connect must be configured and enabled on the LiteLLM instance; deployments relying solely on API key authentication do not invoke the get_redirect_response_from_openid code path and are not affected by this specific vulnerability. The attacker must have network-level access to the LiteLLM proxy's SSO callback endpoint (AV:N, AC:L, AT:N). No victim interaction is required (UI:N). The non-default SSO configuration requirement is the primary limiting factor that constrains the exploitable population to LiteLLM deployments that have explicitly integrated an OIDC identity provider.

The CVSS 4.0 base score of 2.1 - one of the lowest possible - accurately reflects the constrained exploitation conditions: the attacker must already hold a low-privilege authenticated session (PR:L), and impacts are uniformly low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The E:P exploit modifier in the provided CVSS 4.0 vector confirms the POC is factored in, yet the score remains very low, indicating the POC alone does not dramatically change the threat landscape. The vulnerability is not listed in CISA KEV, meaning no confirmed widespread or targeted active exploitation has been established. The gap between the public POC existence and the KEV absence suggests exploitation may be technically straightforward but organizationally low-value for threat actors, given the authenticated prerequisite. Real-world priority is low for most deployments; however, environments where the LiteLLM proxy is used with SSO and multi-tenant user isolation is a security requirement should treat this more seriously, as session persistence can erode user separation boundaries. No EPSS data was provided - exploitation probability cannot be quantitatively assessed beyond the qualitative signals above.

An authenticated LiteLLM proxy user with low-privilege SSO access sends a crafted or replayed OpenID Connect redirect response to the get_redirect_response_from_openid endpoint, triggering the insufficient session expiration flaw and causing the server to accept a session that should have been invalidated. A public exploit POC is available at https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697, significantly lowering the technical barrier. The attacker retains an unauthorized persistent session, accessing the LiteLLM proxy UI and its managed API key or configuration data without re-authenticating.