CVE Watch29 sept 2026

CVE-2026-93355

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to au

CVSS

8.1

Alto

EPSS

0.3%

p20

KEV

—

Exploit Today

0-100

Publicado: 28 sept 2026 · Última mod.: 29 sept 2026 · CWE-1390

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-09-292026-10-25

Descripción técnica

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without verifying the email_verified claim. Attackers can present a token with an unverified email address matching a victim's account to inherit the victim's role, including proxy_admin privileges, and permanently overwrite the victim's stored identity binding to retain persistent unauthorized access to administrative endpoints exposing API keys and user management.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-881017.8 ALT

10.5%

——3Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.9d CVE-2026-859395.3 MED

31.5%

——9Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.10d CVE-2026-859227.4 ALT

48.8%

——15Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.10d CVE-2026-853767.8 ALT

20.1%

——6Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.9d CVE-2026-853287.0 ALT

12.4%

——4Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.9d CVE-2026-853236.8 MED

41.2%

——12Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.10d