Advisory · CVE-2026-93355
LiteLLM lets a valid login token become someone else's admin account
LiteLLM's JWT flow falls back to an email-based user lookup without checking the email_verified claim, so a token from the configured identity provider with a victim's email inherits the victim's role, including proxy_admin.
- Vendor
- BerriAI
- Product
- LiteLLM
- Identifier / CWE
- CVE-2026-93355
CWE-1390 - Action timing
- Immediate
Explain it like I’m five
LiteLLM trusts the email address written on a login token without checking whether the identity provider actually verified it. Anyone holding a valid token can write someone else's email on it and be treated as that person.
- 01Valid token, unverified email
An attacker obtains a legitimate JWT from the configured identity provider with an unverified email address matching a victim's account.
- 02Email fallback lookup
LiteLLM's JWT authentication flow matches the token to an existing user by email without verifying the email_verified claim.
- 03Role inheritance
The attacker inherits the victim's role, including proxy_admin privileges, gaining access to administrative endpoints that expose API keys and user management.
- 04Persistent binding
The victim's stored identity binding is permanently overwritten, retaining the attacker's unauthorized access even after the original token expires.
What happened
LiteLLM 1.102.1 and earlier contains a weak authentication vulnerability in its JWT flow. An attacker holding a valid JWT from the configured identity provider can authenticate as any existing user by exploiting an email-based fallback lookup that does not verify the email_verified claim. Presenting a token with an unverified email address matching a victim’s account lets the attacker inherit the victim’s role, including proxy_admin privileges, and permanently overwrites the victim’s stored identity binding, retaining persistent unauthorized access to administrative endpoints that expose API keys and user management.
What to do
- Inventory LiteLLM proxy deployments, including team-managed and shadow instances.
- Upgrade LiteLLM beyond 1.102.1 to a release containing the fix for the email fallback lookup.
- Review the user identity bindings in the LiteLLM database for unexpected changes or bindings that do not match the identity provider’s records.
- Rotate API keys and rebind user identities; treat any key visible to a proxy_admin as compromised.
- Audit administrative endpoint logs for unusual user-management or key-viewing activity.
Management note
This turns any valid low-privilege login token into a potential admin account on the LLM gateway, where API keys are the crown jewels. Patch, verify identity bindings, and rotate keys as one task rather than three.