---
id: CVE-2026-49468
aliases:
  - GHSA-4xpc-pv4p-pm3w
  - PYSEC-2026-388
title: 'LiteLLM: Authentication Bypass via Host Header Injection'
summary: 'LiteLLM: Authentication Bypass via Host Header Injection'
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: litellm
product: litellm
ecosystem: pip
affected:
  - litellm < 1.84.0
patched:
  - litellm 1.84.0
published: '2026-06-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:48.301716737Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4xpc-pv4p-pm3w'
references:
  - url: 'https://github.com/BerriAI/litellm/security/advisories/GHSA-4xpc-pv4p-pm3w'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49468'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-49468'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491520'
  - url: 'https://github.com/BerriAI/litellm'
  - url: 'https://github.com/BerriAI/litellm/releases/tag/v1.84.0'
  - url: 'https://github.com/advisories/GHSA-4xpc-pv4p-pm3w'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-388.yaml
  - url: 'https://pypi.org/project/litellm'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49468.json
tags:
  - osv
  - pip
  - exploit-available
  - ghsa
epss: 0.00817
epssPercentile: 0.55255
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/BiiTts/CVE-2026-49468-LiteLLM-Auth-Bypass'
  checkedAt: '2026-09-25T08:21:00.486Z'
exploitAvailable: true
cwe:
  - CWE-290
ingestedAt: '2026-06-29T14:31:47.465Z'
---

## Overview

### Impact

A Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes.

The auth layer derived the effective route from `request.url.path` in `litellm/proxy/auth/auth_utils.py::get_request_route()`, which Starlette reconstructs from the `Host` header. A crafted `Host` could therefore make the auth gate evaluate a different route from the one FastAPI dispatched.

**Most deployments are not affected.** The bypass is blocked by any upstream layer that validates or normalizes `Host`, such as:

- a CDN or WAF, such as Cloudflare
- a reverse proxy with `server_name` allowlists
- a host-based load balancer

**LiteLLM Cloud customers are not affected.**

### Patches

Fixed in **`1.84.0`**. Upgrade to `1.84.0` or later. No configuration change is required.

### Workarounds

If upgrading is not immediately possible, place the proxy behind an upstream component that validates or normalizes the `Host` header before forwarding (a CDN/WAF, a reverse proxy with explicit `server_name` allowlists, or a cloud load balancer with host-based routing rules), or otherwise restrict network access to the proxy listener.

### References

- Patched release: [`v1.84.0`](https://github.com/BerriAI/litellm/releases/tag/v1.84.0)

**Discovery Credit**: Le The Thang (KCSC) and Kim Ngoc Chung (One Mount Group)

## Affected packages

- `litellm < 1.84.0`

## Remediation

Upgrade to a patched release:

- `litellm 1.84.0`