{"id":"CVE-2026-49468","published":"2026-06-22T20:37:14Z","modified":"2026-07-15T00:47:34Z","title":"LiteLLM: Authentication Bypass via Host Header Injection","vendor":"BerriAI","product":"litellm","tier":"tail","description":{"text":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. The auth layer derived the effective route from request.url.path in litellm/proxy/auth/auth_utils.py::get_request_route(), which Starlette reconstructs from the Host header. A crafted Host could therefore make the auth gate evaluate a different route from the one FastAPI dispatched. This vulnerability is fixed in 1.84.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.5,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03033,"percentile":0.87478,"provenance":"source"},"cwes":[{"id":"CWE-290","name":"Authentication Bypass by Spoofing"}],"references":[{"url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/BerriAI/litellm/releases/tag/v1.84.0","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49468","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491520","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json","tags":["x_sadp-csaf-vex"]}],"priority":{"score":29.1,"factors":[{"name":"EPSS percentile","points":17.5},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.65}]},"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2026-07-03","earliestUrl":"https://github.com/BiiTts/CVE-2026-49468-LiteLLM-Auth-Bypass","repos":[{"name":"BiiTts/CVE-2026-49468-LiteLLM-Auth-Bypass","url":"https://github.com/BiiTts/CVE-2026-49468-LiteLLM-Auth-Bypass","stars":5,"created":"2026-07-03"}]},"nuclei":[{"id":"CVE-2026-49468","name":"LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass","severity":"critical","path":"http/cves/2026/CVE-2026-49468.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-49468.yaml"}],"first":{"date":"2026-07-03","source":"PoC-in-GitHub","url":"https://github.com/BiiTts/CVE-2026-49468-LiteLLM-Auth-Bypass"},"provenance":"source"},"vendorSlug":"berriai","affectedVersions":[{"vendor":"BerriAI","product":"litellm","versions":["< 1.84.0"]}],"affected":[{"ecosystem":"PyPI","package":"litellm","vulnerableRanges":["<1.84.0"],"patched":["1.84.0"],"from":["GHSA-4xpc-pv4p-pm3w","PYSEC-2026-388"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-38361","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-59819","published":"2026-07-08","fixed":"1.83.10","kev":false},{"cve":"CVE-2026-47101","published":"2026-05-21","fixed":"1.83.14","kev":false,"link":{"from":"CVE-2026-47101","to":"CVE-2026-49468","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:litellm","fromFixed":"1.83.14","toFixed":"1.84.0","daysApart":32}]}},{"cve":"CVE-2026-12773","published":"2026-06-21","fixed":"1.84.0","kev":false},{"cve":"CVE-2026-49468","published":"2026-06-22","fixed":"1.84.0","kev":false},{"cve":"CVE-2026-59822","published":"2026-07-08","fixed":"1.84.0","kev":true},{"cve":"CVE-2026-84377","published":"2026-09-02","fixed":"1.96.2","kev":false},{"cve":"CVE-2026-114612","published":"2026-10-22","fixed":"1.104.0rc2","kev":false}],"package":"PyPI:litellm"}}