CVE Tools
Sign in
Back to feed
Patch released LiteLLM AI Gateway auth-bypass LiteLLM web-app

LiteLLM Authentication Bypass via Host Header Injection (CVE-2026-49468)

Daily CyberSecurity (securityonline.info)·By Do Son··2 min read
CVE Tools coverage

LiteLLM’s authentication can be bypassed when a malicious actor injects a crafted HTTP Host header, potentially allowing unauthenticated access to protected management routes. The issue is tracked as CVE-2026-49468 (CVSS 9.5) affecting litellm (pip) versions earlier than < 1.84.0, making it critical for deployments that expose the proxy directly. Update to 1.84.0 to remediate; no confirmed exploitation was reported at the time of disclosure.

Open on Daily CyberSecurity (securityonline.info)

Related coverage

Other stories on the same CVEs
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure