CVE-2026-35030

9.4

CRITICAL CVSS 4.0

LiteLLM has an authentication bypass via OIDC userinfo cache key collision

Overview

Description

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cached token. On cache hit, the attacker inherits the legitimate user's identity and permissions. This affects deployments with JWT/OIDC authentication enabled. Fixed in v1.83.0.

Details

INFO

Published Date :

April 6, 2026, 5:17 p.m.

Last Modified :

April 7, 2026, 8:20 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Impact

Affected Products

The following products are affected by CVE-2026-35030 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Litellm	litellm

: Total Affected Vendor : 1 | Products : 1

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				134c704f-9b21-4f2e-91b3-4a467353bcc0
	CVSS 4.0	CRITICAL				[email protected]

Solution

Update LiteLLM to version 1.83.0 or later to fix JWT authentication issues.

Update LiteLLM to version 1.83.0 or later.
Verify JWT authentication configuration.
Monitor authentication logs for suspicious activity.

Public PoC/Exploit Available at Github

CVE-2026-35030 has a 2 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-35030.

URL	Resource
https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6	Vendor Advisory Mitigation

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-35030 is associated with the following CWEs:

CWE-287: Improper Authentication

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-35030 weaknesses.

CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-94: Adversary in the Middle (AiTM) Adversary in the Middle (AiTM) CAPEC-114: Authentication Abuse Authentication Abuse CAPEC-115: Authentication Bypass Authentication Bypass CAPEC-151: Identity Spoofing Identity Spoofing CAPEC-194: Fake the Source of Data Fake the Source of Data CAPEC-593: Session Hijacking Session Hijacking CAPEC-633: Token Impersonation Token Impersonation CAPEC-650: Upload a Web Shell to a Web Server Upload a Web Shell to a Web Server

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

webpro255/awesome-ai-agent-attacks

A curated timeline of real AI agent security incidents, breaches, and vulnerabilities (2024-2026). Every entry sourced and dated.

ai-agent-security ai-agents ai-security awesome-list cybersecurity llm-security mcp-security prompt-injection supply-chain-security adversarial-attacks agent-security agentic-ai ai-attacks ai-safety cve incident-response owasp red-team security-research vulnerability

Updated: 1 week ago

7 stars 1 fork 1 watcher

Born at : April 7, 2026, 2:19 p.m. This repo has been linked 55 different CVEs too.

hakandamar/ct-toolkit

Identity Continuity Guardrails for Agentic Systems: An open-source implementation of the Nested Agentic Architecture (NAA) for the autonomous Agentic Web.

agentic-ai ai ai-agent ai-safety autonomus-agents cybersecurity guardrails

Python CSS HTML JavaScript

Updated: 3 weeks, 4 days ago

2 stars 0 fork 0 watcher

Born at : March 12, 2026, 7:50 p.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-35030 vulnerability anywhere in the article.

Daily CyberSecurity

LiteLLM Under Fire: Triple Threat Vulnerabilities Expose AI Gateways to Total Takeover

LiteLLM, the popular open-source library used to provide a unified interface for over 100 Large Language Models (LLMs) like OpenAI and Anthropic, has been hit with a series of critical security disclo ...

Published Date: Apr 13, 2026 (2 weeks, 3 days ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-35030 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

Initial Analysis by [email protected]

Apr. 07, 2026

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:a:litellm:litellm::::::::* versions up to (excluding) 1.83.0
Added	Reference Type		GitHub, Inc.: https://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6 Types: Mitigation, Vendor Advisory

CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0