CVE-2026-93355: Account Takeover in LiteLLM

Security researchers at OX disclosed CVE-2026-93355, an authentication bypass in the open-source LLM gateway LiteLLM that lets an attacker take over any existing user's account, including a proxy_admin, with a single forged request. The flaw stems from LiteLLM's JWT handling: when a token's user_id or sso_user_id doesn't directly match an account, the proxy falls back to matching on the token's email claim without ever checking whether that email has actually been verified. Worse, a successful match not only grants the attacker the victim's session but silently and permanently rewrites the victim's sso_user_id to the attacker's token subject, turning a one-time forged claim into lasting access to every API key, budget, and admin function behind the proxy. Rated CVSS 8.8, the issue affects all versions up to 1.100.1 and remains unpatched as of this disclosure despite being reported to the vendor back in May 2026; a working proof of concept is now public, so administrators are urged to enforce verified-email claims and pin identity to stable subject IDs as interim mitigations.