{"schema":"threatline.record/2","record":{"id":"CVE-2026-93355","aliases":[],"summary":"LiteLLM Weak JWT Authentication via Email-Based User Lookup","details":"LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim's account to inherit the victim's role, including proxy_admin privileges, and permanently overwrite the victim's stored identity binding to retain persistent unauthorized access to administrative endpoints exposing API keys and user management.","categories":["Unclassified"],"product":"litellm","vendor":"BerriAI","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93355","source_modified_at":"2026-10-01T15:21:59.696Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"litellm","vendor":"BerriAI","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"1.102.1"},{"status":"affected","version":"0","versionType":"git","lessThanOrEqual":"f4308bc124eebc783dfc51790ce8db27ed21ae00"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":7.6,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00273,"percentile":0.18711,"score_date":"2026-10-23"},"published_at":"2026-09-28T19:26:01.155Z","modified_at":"2026-10-01T15:21:59.696Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-93355","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-01T15:21:59.696Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-93355","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.ox.security/blog/litellm-an-ordinary-login-token-can-become-someone-elses-admin-account/","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/litellm-weak-jwt-authentication-via-email-based-user-lookup","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-09-29T14:01:26.547066Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-01T15:21:59.696Z","content_hash":"5a73b3bf31156afd1231f427017644fa28070d02b5cafb682325c62cae1e890b"}}