Executive Summary

As enterprise engineering teams consolidate artificial intelligence architectures, AI model gateways like LiteLLM have emerged as mission-critical middleware orchestrating routing, load balancing, cost tracking, and security controls across heterogeneous foundation models. Project maintainers and security researchers have disclosed a critical authentication bypass flaw, designated CVE-2026-55102, impacting LiteLLM Proxy deployments prior to version 1.42.1. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

The flaw allows remote unauthenticated attackers to bypass JSON Web Token (JWT) signature validation checks when querying the proxy's core completion and embeddings endpoints. Exploitation permits unauthorized execution against internal enterprise foundation models, exfiltration of organizational system prompts, and depletion of corporate LLM API budgets.

Vulnerability Mechanics: Key Confusion in PyJWT Verification

The root cause resides in the token verification callback implemented within litellm/proxy/auth/user_api_key_auth.py. When parsing incoming Bearer tokens, the proxy dynamically selected the verification algorithm based on the untrusted token header's alg field rather than enforcing a rigid server-side whitelist.

When an asymmetric algorithm (e.g. RS256) was declared in the server configuration, an attacker could sign a forged administrative token using the HMAC algorithm (HS256) with the server's publicly accessible RSA public key as the HMAC symmetric secret. The verification library treated the public key string as the HMAC shared secret, validating the forged signature successfully and granting full administrator access.

# Representation of the algorithm confusion vulnerability in LiteLLM auth
import jwt

# Attacker crafts forged token using public key as symmetric secret
forged_payload = {
    "user_id": "cst-admin",
    "team_id": "platform-engineering",
    "models": ["*"],
    "spend": 0.0
}
# Signing with HS256 using server public key bytes
token = jwt.encode(forged_payload, public_key_pem, algorithm="HS256")
# In vulnerable versions, proxy accepted token because alg was not strictly enforced

Enterprise Threat Landscape & API Budget Exposure

In enterprise topologies, LiteLLM sits directly upstream of high-value internal models (e.g., fine-tuned Llama 3 weights on Kubernetes) and commercial cloud accounts (AWS Bedrock, Azure OpenAI, Google Vertex AI). Successful exploitation allows an adversary to:

  • Bypass all spend quotas and rate limits, potentially inflicting thousands of dollars in cloud API consumption costs.
  • Extract proprietary corporate system prompts, guardrail instructions, and internal RAG document contexts.
  • Inject malicious instructions into downstream automated agents relying on LiteLLM for tool calling.

Remediation Checklist

Administrators operating LiteLLM Proxy instances must execute the following hardening protocol:

  1. Upgrade Immediately: Deploy LiteLLM version 1.42.1 or higher, which forces rigid algorithm whitelisting and validates key types strictly before verification.
  2. Rotate Proxy Master Keys: Regenerate all LITELLM_MASTER_KEY and downstream cloud provider secrets if the proxy was exposed to untrusted subnets.
  3. Enforce Ingress mTLS: Place AI proxy interfaces behind internal ingress controllers enforcing mutual TLS (mTLS) or OAuth2 gateway boundaries.