CVE-2026-12795
BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authentication
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 21, 2026
- Updated
- Jun 23, 2026
- Reserved
- Jun 20, 2026
Description
A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
litellmBerriAI |
|
References
- VDB-372557 | BerriAI litellm SSO Debug Flow ui_sso.py json.dumps missing authenticationvdb-entrytechnical-description
- VDB-372557 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-12795 | CVE Analysis and Reportthird-party-advisory
- Submit #811286 | litellm <= 1.82.2 Missing Authentication for Critical Function (CWE-306)third-party-advisory
- https://gist.github.com/YLChen-007/9b13c75a3a73187a4082cc6df0b100d3exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.