Unpatched LiteLLM flaw lets one login take over admin accounts

What happened

CVE-2026-93355, published on 28 September 2026 and scored CVSS 3.1 8.1, lets anyone holding a valid token from a LiteLLM proxy's configured identity provider sign in as an existing user whose email matches the token's unverified email claim. The attacker inherits the victim's role, including proxy_admin, and the login permanently rebinds the victim's stored identity to the attacker, leaving lasting access to API keys and user management.

The record credits Nir Zadok and Moshe Siman Tov Bustan of OX Security, who reported it to LiteLLM on 18 May 2026, followed up on 27 July and published on 29 September after about 120 days with no vendor response; OX scores it 8.8. The record lists versions up to 1.102.1 as affected, and no fixed release was confirmed as of 2 October 2026, when 1.103.2 was the latest on PyPI. OX advises requiring email_verified to be true at the identity provider, or stripping the email claim from tokens that lack it.