CVE-2026-12796

MEDIUM

BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration

Title source: cna

Description

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-372558 | BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid session expiration

https://vuldb.com/vuln/372558

Signature, Permissions Required signature permissions-required

VDB-372558 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/372558/cti

Third Party Advisory third-party-advisory

CVE-2026-12796 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-12796

Third Party Advisory third-party-advisory

Submit #811287 | litellm <= 1.82.2 Insufficient Session Expiration (CWE-613)

https://vuldb.com/submit/811287

Exploit exploit

https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697

Scores

CVSS v3 6.3

EPSS 0.0036

EPSS Percentile 28.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-613

Status published

Products (4)

BerriAI/litellm 1.82.0

BerriAI/litellm 1.82.1

BerriAI/litellm 1.82.2

litellm/litellm < 1.82.2

Published Jun 21, 2026

Tracked Since Jun 21, 2026