GHSA-hhww-mrg2-969h

LiteLLM vulnerable to reflected XSS in /sso/debug/callback

Risk score: 46/100
CVSS: 6.8 v3.1
Published: 27 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline <script> block via json.dumps, which escapes JSON string syntax but not HTML context characters such as </script>. An IdP-returned string field containing </script> (for example a user-editable display name) closed the script…
Affected: litellm (pip) >= 1.65.5, < 1.85.0
Fix: Upgrade litellm to 1.85.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

litellm: Amber, patch this week. A privilege escalation vulnerability in LiteLLM proxy server allows an authenticated internal user to gain administrative access and execute arbitrary commands. An attacker could exploit this by replaying a forged administrator credential as a bearer token.

The flaws

GHSA-hhww-mrg2-969h: LiteLLM vulnerable to reflected XSS in /sso/debug/callback (CVSS 6.8)
CVE-2026-114612: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key (CVSS 9.9 · EPSS 0%)
GHSA-g5ff-637f-6q2m: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials` (CVSS 8.1)
CVE-2026-84377: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters (CVSS 6.5 · EPSS 1%)

The fix

Upgrade litellm: 1.96.2 · 1.95.1 · 1.94.3 · 1.93.2 · 1.92.2 · 1.91.5 or later on your release line

Who is exposed: {'products': ['LiteLLM'], 'packages': [{'ecosystem': 'pip', 'name': 'litellm', 'vulnerable': '>= 1.91.0, < 1.100.4', 'patched': '1.100.4'}, {'ecosystem': 'pip', 'name': 'litellm', 'vulnerable': '>= 1.101.0, < 1.101.3', 'patched': '1.101.3'}, {'ecosystem': 'pip', 'name': 'litellm', 'vulnerable': '>= 1.102.0, < 1.102.2'…

Where it stands

No known exploitation

Connects to

Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days

Why it is Yellow

CVSS 6.8 medium
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
litellm	pip	>= 1.65.5, < 1.85.0	1.85.0

References

Original description

### Summary The `/sso/debug/callback` endpoint reflected identity-provider-controlled fields into an inline `<script>` block via `json.dumps`, which escapes JSON string syntax but not HTML context characters such as `</script>`. An IdP-returned string field containing `</script>` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin. ### Impact Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.

Last activity 27 Oct 2026. Patch Forecast updates every hour.