https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:44:42 +0000 https://db.gcve.eu/vuln/ghsa-jjhc-v7c2-5hh6 <p><strong>Affected:</strong> PyPI: litellm</p> <p>### Impact</p> <p>When JWT authentication is enabled (`enable_jwt_auth: true`), the OIDC userinfo cache uses `token[:20]` as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.</p> <p>This configuration option is not enabled by default. **Most instances are not affected.**</p> <p>An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user&#39;s cached token. On cache hit, the attacker inherits the legitimate user&#39;s identity and permissions. This affects deployments with JWT/OIDC authentication enabled.</p> <p>### Patches</p> <p>Fixed in v1.83.0. The cache key now uses the full hash of the JWT token.</p> <p>### Workarounds</p> <p>Disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.</p> <p><strong>Affected:</strong> PyPI: litellm</p> <p>### Impact</p> <p>When JWT authentication is enabled (`enable_jwt_auth: true`), the OIDC userinfo cache uses `token[:20]` as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters.</p> <p>This configuration option is not enabled by default. **Most instances are not affected.**</p> <p>An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user&#39;s cached token. On cache hit, the attacker inherits the legitimate user&#39;s identity and permissions. This affects deployments with JWT/OIDC authentication enabled.</p> <p>### Patches</p> <p>Fixed in v1.83.0. The cache key now uses the full hash of the JWT token.</p> <p>### Workarounds</p> <p>Disable OIDC userinfo caching by setting the cache TTL to 0, or disable JWT authentication entirely.</p> https://db.gcve.eu/vuln/ghsa-jjhc-v7c2-5hh6