LiteLLM, an AI gateway, uses JWT authentication when enable_jwt_auth is set to true. Prior to version 1.83.0, the OIDC userinfo cache key is derived from the first 20 characters of the token. Because JWT headers generated by the same signing algorithm produce identical prefixes, an attacker can create a token whose prefix matches a legitimate cached token. When the cache is consulted, the attacker receives the legitimate user's identity and permissions, effectively bypassing authentication. This flaw allows an unauthenticated user to act as any authenticated user, gaining unauthorized access to protected resources.

Affected deployments include BerriAI's LiteLLM environments running versions prior to 1.83.0 with JWT/OIDC authentication enabled. Systems that have not enabled enable_jwt_auth or are already running 1.83.0 or later are not impacted.

The vulnerability carries a CVSS score of 9.4, indicating critical severity. Its EPSS score is less than 1%, suggesting a low probability of exploitation in the wild, and it is not listed in the CISA KEV catalog. Nevertheless, the attack scenario is straightforward: an attacker must supply a crafted JWT token that matches the cache key of an existing authenticated user. If the system is operating with JWT enabled, the attacker can trigger a cache hit and inherit that user's permissions with minimal effort, making the risk high for any exposed instance.