🚨 CRITICAL: CVE-2026-35030 - LiteLLM Authentication Bypass via OIDC Cache Collision

[jjasghar]

🚨 CRITICAL: CVE-2026-35030 - LiteLLM Authentication Bypass via OIDC Cache Collision

Severity: CRITICAL

GHSA: GHSA-jjhc-v7c2-5hh6
CVE: CVE-2026-35030
Affected Package: litellm
Impact: Authentication Bypass

Description

Authentication bypass vulnerability in LiteLLM through OIDC userinfo cache key collision. This allows attackers to potentially access unauthorized resources by exploiting how cached user information is keyed and retrieved.

Impact Details

• Authentication Bypass: Users may gain access to systems/resources without proper authentication
• Cache Key Collision: Improper caching mechanism enables identity confusion attacks
• Affected Files: 8 files in the repository

Potential Attack Scenarios

1. Attacker triggers cache collision to impersonate another user
2. Unauthorized access to protected API endpoints
3. Privilege escalation through cached credentials

Remediation Steps

1. Update litellm package to the patched version per GHSA-jjhc-v7c2-5hh6
2. Review and fix OIDC cache key generation logic
3. Implement proper cache isolation between different users/sessions
4. Audit authentication flows for similar cache-related vulnerabilities

References

• GHSA-jjhc-v7c2-5hh6
• CVE-2026-35030

Priority

IMMEDIATE ACTION REQUIRED - Authentication bypass vulnerabilities are among the most severe security issues.

---

Automated security scan detected this critical vulnerability. Please prioritize remediation.