Live › vulnerability › GHSA-hhww-mrg2-969h
Go to dashboardThe LiteLLM proxy's /sso/debug/callback endpoint places identity-provider-supplied fields into an inline script block without HTML escaping, so a value containing </script> breaks out and runs JavaScript. An attacker who controls an account on the configured IdP can send a crafted callback URL to a logged-in proxy admin and read the dashboard session cookie, leading to admin account takeover.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:34 UTC. All times on this page are UTC.
Deployments of the LiteLLM proxy from 1.65.5 up to but not including 1.85.0 that have SSO login enabled, since the debug callback route is exposed through the SSO flow. The attacker must control an account on the configured identity provider whose claims carry the malicious string, and the victim must be a logged-in proxy admin who opens the crafted link. Installations without SSO configured or with the debug route blocked can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| litellm | pypi | >= 1.65.5, < 1.85.0 | 1.85.0 |
pip show litellm and compare it to the affected range >= 1.65.5, < 1.85.0./sso/debug/callback route is reachable from the internet.litellm to 1.85.0 or later./sso/debug/callback at the reverse proxy.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline <script> block via json.dumps, which escapes JSON string syntax but not HTML context characters such as </script>. An IdP-returned string field containing </script> (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.
Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.
This page as .md · .json · in your agent: get_signal("GHSA-hhww-mrg2-969h")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.