{
 "id": "AIR-2026-0215",
 "slug": "cve-2026-93355-litellm-weak-jwt-authentication-vulnerability",
 "title": "CVE-2026-93355: LiteLLM Weak JWT Authentication Vulnerability",
 "summary": "A weak authentication flaw in LiteLLM allowed users to impersonate others via unverified email claims in JWTs, potentially granting proxy admin privileges. No active exploitation was reported at the time of disclosure.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "LiteLLM"
 ],
 "incident_date": "2026-09-28",
 "incident_date_precision": "day",
 "first_reported": "2026-09-28",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93355",
   "publisher": "NVD",
   "title": "CVE-2026-93355: LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity…",
   "published_at": "2026-09-28"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-93355",
  "litellm",
  "jwt",
  "authentication_bypass"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}