GHSA-hhww-mrg2-969h
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
GHSA-hhww-mrg2-969h is a medium vulnerability (CVSS 6.8) in litellm, published October 27, 2026. No source lists public exploit code. Fixed in litellm 1.85.0.
- Severity
- 6.8 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.85.0litellm +1 more
Description
Summary
The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline <script> block via json.dumps, which escapes JSON string syntax but not HTML context characters such as </script>. An IdP-returned string field containing </script> (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.
Impact
Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
litellmPyPI | 1.65.5 up to 1.85.0 | 1.85.0 |
litellmPyPI | 1.65.5 up to 1.85.0, plus listed versions 1.65.61.65.71.65.81.66.01.66.1 Show 45 moreShow less1.66.21.66.31.67.01.67.0.post11.67.11.67.21.67.41.67.4.dev11.67.4.post11.67.51.67.61.68.01.68.11.68.1.dev11.68.21.69.01.69.11.69.21.69.31.70.01.70.21.70.41.71.01.71.11.71.21.71.31.72.01.72.11.72.21.72.2.post11.72.31.72.41.72.5.dev11.72.5.dev21.72.5.dev31.72.61.72.6.post11.72.6.post21.72.71.72.7.dev11.72.7.dev71.72.91.73.01.73.0.post11.73.0rc1 | 1.85.0 |
What each source reports
GitHub Advisories Score used
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
Summary
The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline <script> block via json.dumps, which escapes JSON string syntax but not HTML context characters such as </script>. An IdP-returned string field containing </script> (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.
Impact
Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.
- Record
GHSA-hhww-mrg2-969h- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
Summary
The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline <script> block via json.dumps, which escapes JSON string syntax but not HTML context characters such as </script>. An IdP-returned string field containing </script> (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.
Impact
Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.
- Record
GHSA-hhww-mrg2-969h- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 147 versions. The JSON record has them.