/Vulnerability Library

LiteLLM Proxy < 1.84.0 - Host Header Authentication Bypass

CVE-2026-49468
Verified

Description

LiteLLM Proxy before 1.84.0 derives its public-route authorization check from a URL reconstructed with the unvalidated Host header. A Host value containing a fragment can make a protected request appear to target the public root route, bypassing the API-key check. Version 1.84.0 derives the route from the raw ASGI path instead.

Severity

Critical

CVSS Score

8.1

Exploit Probability

3%

Affected Product

litellm

Published Date

September 1, 2026

Template Author

str4k3r

CVE-2026-49468.yaml
8.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:H/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-49468
CWE ID:
cwe-290

References

https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3whttps://github.com/BerriAI/litellm/releases/tag/v1.84.0https://nvd.nist.gov/vuln/detail/CVE-2026-49468

Remediation Steps

Upgrade LiteLLM Proxy to 1.84.0 or later.