CVE-2026-12796

Katalog CVE

CVSS 6.3 · Medium EPSS 0,57%

Kerentanan Insufficient Session Expiration pada litellm. Skor CVSS 3.1 6.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get_redirect_response_from_openid of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Rincian

Terbit di NVD

21 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/5fa8af12e1b183674d7ca96d852fb697 exploit · advisory pihak ketiga
• https://vuldb.com/cve/CVE-2026-12796 advisory pihak ketiga · vdb entry
• https://vuldb.com/submit/811287 advisory pihak ketiga · exploit · vdb entry
• https://vuldb.com/vuln/372558 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/372558/cti permissions required · vdb entry