CVE-2026-35030

When 'enable_jwt_auth: true' is enabled, the OIDC userinfo cache mechanism uses only the first 20 characters of the token (token[:20]) as the cache key. JWT tokens signed with the same algorithm can generate identical first 20 characters. An attacker can craft a token whose first 20 characters match the token of a legitimate user already in the cache. In case of a cache hit, the attacker assumes the identity and permissions of that user without needing to possess valid credentials.

An attacker gains unauthorized access to resources and functionalities available to a legitimate user, potentially including full control over external systems (SC:H/SI:H) with which LiteLLM integrates as an AI Gateway.

LiteLLM should be updated to version 1.83.0 or later, which fixes the cache key generation mechanism. Until the update is applied, as a workaround, disabling the 'enable_jwt_auth' option can be considered if it is not strictly required.

LiteLLM (product by BerriAI) in versions earlier than 1.83.0, only in configurations with the 'enable_jwt_auth: true' option enabled. This option is not active by default, which limits the scope of the vulnerability.