CVE-2026-93355

LiteLLM JWT Email Fallback Lets Unverified Login Tokens Take Over Proxy Admin Accounts, With No Fix Released

LiteLLM CVE-2026-93355 lets a signed JWT with an unverified email claim seize any account, including proxy_admin. No fix yet; cache-leak and SSRF CVEs patched.