LiteLLM is a proxy server that forwards LLM API requests to OpenAI or native backends. Before version 1.84.0, a flaw in the proxy’s Host‑header parsing allowed an attacker to craft a Host header that would cause Starlette to reconstruct a different request.url.path than the one FastAPI dispatched. The auth layer, which uses request.url.path from litellm/proxy/auth/auth_utils.py::get_request_route(), would then evaluate a different route, enabling unauthenticated access to otherwise protected management endpoints. This constitutes a breach of authentication (CWE‑290).

The vulnerability affects the BerriAI:litellm product. Any deployment of LiteLLM prior to version 1.84.0 is susceptible; version 1.84.0 and later contain the fix.

The CVSS score is 9.5, indicating critical severity. The EPSS score of less than 1 % is low but not zero, suggesting a very small probability that is not listed in CISA’s KEV catalog, indicating no known active exploitation at present. The likely attack vector is a network‑based Host header injection performed over HTTP, so systems exposed to external networks could be compromised if the host header is not properly validated.