CVE-2026-93355 Overview
LiteLLM contains a weak authentication vulnerability in its JSON Web Token (JWT) authentication flow. The flaw allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user. LiteLLM performs an email-based fallback lookup without verifying the email_verified claim, letting an attacker present a token with an unverified email that matches a victim's account. Successful exploitation inherits the victim's role, including proxy_admin, and permanently overwrites the victim's stored identity binding. This gives the attacker persistent access to administrative endpoints that expose API keys and user management functions. The weakness is tracked under CWE-1390.
Critical Impact
An authenticated attacker with any valid IdP-issued JWT can escalate to proxy_admin and permanently hijack administrator accounts, exposing API keys and user management endpoints.
Affected Products
- LiteLLM proxy deployments using JWT authentication with a configured identity provider
- LiteLLM configurations relying on the email-based user lookup fallback
- LiteLLM instances exposing /user/* and administrative management endpoints
Discovery Timeline
- 2026-09-28 - CVE-2026-93355 published to the National Vulnerability Database (NVD)
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-93355
Vulnerability Analysis
LiteLLM validates inbound JWTs against the configured identity provider, then resolves the token to a local user record. When the primary subject-based lookup fails, the code falls back to an email-based lookup using the email claim from the JWT. This fallback does not verify the OpenID Connect email_verified claim before treating the email as an authoritative identifier.
An attacker who can obtain any valid JWT from the same identity provider can populate the email claim with a target administrator's address. LiteLLM then binds the attacker's token subject to the victim's user record, inheriting the victim's role and permissions. Because the binding is persisted, the attacker retains access even after the victim reauthenticates. Administrative roles such as proxy_admin expose endpoints that manage API keys and users, enabling full compromise of the proxy.
Root Cause
The root cause is a use of an unverified assertion for authentication decisions [CWE-1390]. The JWT authentication handler trusts the email claim as a stable identifier without requiring email_verified: true or restricting fallback lookups to trusted issuer configurations. Identity providers that allow self-asserted or unverified email addresses become an authentication oracle for the proxy.
Attack Vector
Exploitation requires network access to the LiteLLM proxy and the ability to obtain a valid JWT from the configured identity provider. Many identity providers permit self-registration or allow users to set arbitrary email values in profile fields that flow into token claims. The attacker crafts or requests a token where the email claim matches the victim's registered email, then presents the token to any authenticated LiteLLM endpoint. The email-based fallback matches the victim's record and overwrites the stored subject binding with the attacker's token identifier, granting persistent access.
Refer to the Ox Security research write-up and the VulnCheck advisory for full technical details.
Detection Methods for CVE-2026-93355
Indicators of Compromise
- Changes to the stored JWT subject or sub binding on existing user records without a corresponding administrative action.
- Successful authentication events where the token sub differs from the historical sub value for the same user email.
- Unexpected role elevation events or new API keys minted from proxy_admin sessions.
- JWTs presented to LiteLLM whose email_verified claim is false or missing.
Detection Strategies
- Enable verbose authentication logging on the LiteLLM proxy and alert on user-record subject overwrites.
- Correlate identity provider audit logs with LiteLLM authentication logs to detect email-claim mismatches between IdP profiles and token payloads.
- Baseline administrative endpoint usage (/user/new, /key/generate, /user/update) and alert on out-of-pattern calls.
Monitoring Recommendations
- Monitor for JWTs carrying email_verified: false or missing email_verified claims that still result in successful authentication.
- Track creation and rotation of API keys, particularly those attributed to accounts holding proxy_admin.
- Forward LiteLLM proxy logs to a centralized data lake and retain identity provider sign-in telemetry for correlation.
How to Mitigate CVE-2026-93355
Immediate Actions Required
- Upgrade LiteLLM to the fixed release identified in the VulnCheck advisory as soon as available.
- Audit all user records for unexpected changes to the stored JWT subject binding and revert unauthorized modifications.
- Rotate all API keys issued by the LiteLLM proxy, prioritizing keys owned by proxy_admin accounts.
- Restrict identity provider registration to trusted domains and require verified email addresses at the IdP level.
Patch Information
Refer to the VulnCheck security advisory and the upstream LiteLLM project for the patched version that removes or hardens the email-based JWT fallback. Apply vendor guidance to enforce verification of the email_verified claim before any email-based user resolution.
Workarounds
- Disable the email-based fallback lookup in the JWT authentication configuration where supported.
- Restrict LiteLLM to identity providers and tenants that guarantee verified email claims and disallow self-asserted email values.
- Place the LiteLLM administrative endpoints behind network-level access controls or a reverse proxy that enforces additional authentication.
- Reduce the number of accounts holding proxy_admin and require multi-factor authentication at the identity provider for those accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.