CVE-2026-35030 BerriAI CVE debrief

Who should care

Organizations using LiteLLM with JWT/OIDC authentication enabled should prioritize patching to version 1.83.0 or later. Security teams and administrators responsible for LLM API proxy servers should assess their exposure and take immediate action to protect against potential exploitation.

Technical summary

The vulnerability in LiteLLM arises from the implementation of JWT authentication. When enable_jwt_auth is set to true, the OIDC userinfo cache uses a truncated version of the JWT token (token[:20]) as the cache key. Since JWT headers produced by the same signing algorithm have identical first 20 characters, an attacker can craft a token that matches a legitimate user's cached token. Upon cache hit, the attacker gains the legitimate user's identity and permissions. This vulnerability is particularly severe as it allows for unauthenticated access and has a high CVSS score of 9.4.

Defensive priority

Immediate patching to version 1.83.0 or later is crucial for organizations using LiteLLM with JWT/OIDC authentication. In the interim, defenders should review their configurations and monitor for suspicious activity.

Recommended defensive actions

• Patch LiteLLM to version 1.83.0 or later immediately.
• Review and adjust JWT/OIDC authentication configurations to enhance security.
• Monitor for suspicious activity and potential exploitation attempts.
• Assess the scope of affected deployments and prioritize remediation.
• Implement compensating controls, such as additional authentication layers, if patching is not feasible in the short term.

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. Vendor advisories and mitigation strategies are available through GitHub and Red Hat errata. The vulnerability's critical severity and potential for exploitation necessitate swift action.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.