LiteLLM, a proxy server for Large Language Model APIs, contains a flaw that allows an attacker to bypass authentication by injecting a malicious Host header. This weakness enables an attacker to execute unauthorized requests through the proxy, potentially accessing or abusing connected LLM services. The flaw is classified as CWE‑290, reflecting a failure to enforce proper authentication controls.

The vulnerability affects the BerriAI:litellm product. Any deployment of LiteLLM prior to version 1.84.0 is susceptible; version 1.84.0 and later contain the fix.

The CVSS score is 9.5, indicating critical severity. While the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits at present. The likely attack vector is a network‑based Host header injection performed over HTTP, indicating that systems exposed to external networks could be compromised if the host header is not properly validated.