---
id: "GHSA-hhww-mrg2-969h"
kind: "vulnerability"
aliases: ["GHSA-hhww-mrg2-969h"]
title: "LiteLLM vulnerable to reflected XSS in /sso/debug/callback"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "litellm", "fixed": ["1.85.0"], "affected": ">= 1.65.5, < 1.85.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "cwe-79", "litellm", "python", "self-hosted", "sso"]
not_affected_if: ["default-config", "sso-not-configured"]
published_at: "2026-10-27T15:31:56+00:00"
first_seen_at: "2026-10-27T15:34:05+00:00"
updated_at: "2026-10-27T15:35:43+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hhww-mrg2-969h", "first_seen_at": "2026-10-27T15:34:05+00:00"}]
---

# LiteLLM vulnerable to reflected XSS in /sso/debug/callback

The LiteLLM proxy's /sso/debug/callback endpoint places identity-provider-supplied fields into an inline script block without HTML escaping, so a value containing </script> breaks out and runs JavaScript. An attacker who controls an account on the configured IdP can send a crafted callback URL to a logged-in proxy admin and read the dashboard session cookie, leading to admin account takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:litellm affected >= 1.65.5, < 1.85.0 fixed 1.85.0

## How to check

- Check the installed version with `pip show litellm` and compare it to the affected range `>= 1.65.5, < 1.85.0`.
- Confirm whether SSO is configured on the proxy and whether the `/sso/debug/callback` route is reachable from the internet.

## Fix

- Upgrade `litellm` to `1.85.0` or later.
- Until upgraded, block or restrict access to `/sso/debug/callback` at the reverse proxy.

## Timeline

- 2026-10-27T15:34:05+00:00 ghsa https://github.com/advisories/GHSA-hhww-mrg2-969h

## From the sources

### Summary

The `/sso/debug/callback` endpoint reflected identity-provider-controlled fields into an inline `<script>` block via `json.dumps`, which escapes JSON string syntax but not HTML context characters such as `</script>`. An IdP-returned string field containing `</script>` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.

### Impact

Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_