Exploit for Authentication Bypass by Spoofing in Litellm

CVE-2026-49468 — LiteLLM Unauthenticated Auth Bypass via Host-...

CVE-2026-49468

A flaw was found in LiteLLM, a proxy server AI Gateway used to call Large Language Model LLM APIs. A remote attacker could exploit a Host-header parsing vulnerability in the proxy authentication layer. By sending a crafted Host header, an attacker could gain unauthenticated access to protected...