2026-04-15 · 2026-Q2
LiteLLM OIDC Userinfo Cache Authentication Bypass
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
LiteLLM (BerriAI LLM gateway) deployments with JWT auth enabled
Impact
Unauthenticated attacker can craft a token whose first 20 characters collide with a cached legitimate token, inheriting that user's identity and permissions across the gateway
Root cause
OIDC userinfo cache keyed on token[:20] instead of the full token or a secure hash; JWTs produced by the same signing algorithm share the same header prefix
CVE
Sources
Catalog
Cite this: AgentProv incident record: LiteLLM OIDC Userinfo Cache Authentication Bypass (2026-04-15). https://agentprov.com/incidents/2026-04-15-litellm-oidc-userinfo-cache-authentication-bypass
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run