{"id":"GHSA-hhww-mrg2-969h","kind":"vulnerability","aliases":["GHSA-hhww-mrg2-969h"],"related":[],"title":"LiteLLM vulnerable to reflected XSS in /sso/debug/callback","description":"### Summary\n\nThe `/sso/debug/callback` endpoint reflected identity-provider-controlled fields into an inline `<script>` block via `json.dumps`, which escapes JSON string syntax but not HTML context characters such as `</script>`. An IdP-returned string field containing `</script>` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.\n\n### Impact\n\nReflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.","summary":"The LiteLLM proxy's /sso/debug/callback endpoint places identity-provider-supplied fields into an inline script block without HTML escaping, so a value containing </script> breaks out and runs JavaScript. An attacker who controls an account on the configured IdP can send a crafted callback URL to a logged-in proxy admin and read the dashboard session cookie, leading to admin account takeover.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"litellm","fixed":["1.85.0"],"affected":">= 1.65.5, < 1.85.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-79","litellm","python","self-hosted","sso"],"not_affected_if":["default-config","sso-not-configured"],"how_to_check":"- Check the installed version with `pip show litellm` and compare it to the affected range `>= 1.65.5, < 1.85.0`.\n- Confirm whether SSO is configured on the proxy and whether the `/sso/debug/callback` route is reachable from the internet.","fix":"- Upgrade `litellm` to `1.85.0` or later.\n- Until upgraded, block or restrict access to `/sso/debug/callback` at the reverse proxy.","status":"open","published_at":"2026-10-27T15:31:56+00:00","first_seen_at":"2026-10-27T15:34:05+00:00","triaged_at":"2026-10-27T15:35:43+00:00","updated_at":"2026-10-27T15:35:43+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T15:35:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `litellm` to `1.85.0` or later.\n- Until upgraded, block or restrict access to `/sso/debug/callback` at the reverse proxy.","reach":"internet","title":"LiteLLM: SSO debug callback reflects unescaped IdP fields, enabling script injection","impact":"high","summary":"The LiteLLM proxy's /sso/debug/callback endpoint places identity-provider-supplied fields into an inline script block without HTML escaping, so a value containing </script> breaks out and runs JavaScript. An attacker who controls an account on the configured IdP can send a crafted callback URL to a logged-in proxy admin and read the dashboard session cookie, leading to admin account takeover.","category":"ai-tooling","nicknames":[],"who_cares":["litellm","python","self-hosted","sso"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs scripts in admin origin, steals session, takes over account","analyst_note":"","how_to_check":"- Check the installed version with `pip show litellm` and compare it to the affected range `>= 1.65.5, < 1.85.0`.\n- Confirm whether SSO is configured on the proxy and whether the `/sso/debug/callback` route is reachable from the internet.","needs_analyst":false,"not_affected_if":["sso-not-configured","default-config"],"who_is_affected":"Deployments of the LiteLLM proxy from 1.65.5 up to but not including 1.85.0 that have SSO login enabled, since the debug callback route is exposed through the SSO flow. The attacker must control an account on the configured identity provider whose claims carry the malicious string, and the victim must be a logged-in proxy admin who opens the crafted link. Installations without SSO configured or with the debug route blocked can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":3537,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-79':23B '/sso/debug/callback':7A,34B,95C '969h':12A,17A 'account':64B,91B,152C,206C 'act':196C 'admin':81B,90B,182C,205C 'ai':20B 'ai-tool':19B 'attack':60B,127C,149C 'authent':146C 'block':46B,124C 'break':54B 'callback':73B,174C 'claim':158C 'close':121C 'complet':165C 'configur':67B,155C 'contain':53B,112C 'control':62B,101C 'cooki':87B,194C 'could':164C 'craft':72B 'cwe':22B 'dashboard':85B,192C 'deliv':171C 'display':119C 'edit':118C 'endpoint':35B,96C 'escap':49B 'exampl':114C 'execut':126C,184C 'field':41B,102C,111C 'flow':168C 'full':204C 'ghsa':9A,14A 'ghsa-hhww-mrg2-969h':8A,13A 'hhww':10A,15A 'host':28B 'html':48B 'ident':38B,99C 'identity-provider-control':98C 'identity-provider-suppli':37B 'idp':68B,108C,156C 'idp-return':107C 'impact':134C 'inlin':44B,105C 'javascript':58B,128C 'lead':88B 'litellm':1A,18A,24B,31B,139C 'log':78B,179C 'logged-in':77B,178C 'mrg2':11A,16A 'name':120C 'origin':133C,141C,188C 'pass':159C 'place':36B 'privileg':201C 'provid':39B,100C 'proxi':32B,80B,131C,140C,181C,187C 'python':25B 'read':83B,190C 'reflect':4A,97C,135C 'requir':144C 'result':173C 'return':109C 'rout':143C 'run':57B 'script':45B,123C,183C 'self':27B 'self-host':26B 'send':70B 'session':86B,193C 'sso':29B,167C 'string':110C,161C 'summari':93C 'suppli':40B 'takeov':92B,207C 'tool':21B 'url':74B,175C 'user':117C 'user-edit':116C 'valu':52B 'verbatim':163C 'victim':199C 'vulner':2A 'whose':157C 'without':47B 'xss':5A,136C","nicknames":[],"mitigations":[],"who_affected":"Deployments of the LiteLLM proxy from 1.65.5 up to but not including 1.85.0 that have SSO login enabled, since the debug callback route is exposed through the SSO flow. The attacker must control an account on the configured identity provider whose claims carry the malicious string, and the victim must be a logged-in proxy admin who opens the crafted link. Installations without SSO configured or with the debug route blocked can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:31:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hhww-mrg2-969h","url":"https://github.com/advisories/GHSA-hhww-mrg2-969h","severity":"medium","published_at":"2026-10-27T15:31:56+00:00","modified_at":"2026-10-27T15:31:58+00:00","first_seen_at":"2026-10-27T15:34:05+00:00","fetched_at":"2026-10-27T15:34:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}