`. An IdP-returned string field containing `` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.\n\n### Impact\n\nReflected XSS on the LiteLLM proxy origin. The route required no authentication, s","image":"https://o3.security/opengraph.png","datePublished":"2026-10-27T15:31:56Z","dateModified":"2026-10-27T15:47:24.395753522Z","url":"https://o3.security/vulnerability/GHSA-hhww-mrg2-969h","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/GHSA-hhww-mrg2-969h"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"litellm","applicationCategory":"PyPI","softwareVersion":"1.85.0"}],"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-hhww-mrg2-969h"},{"@type":"CreativeWork","url":"https://github.com/BerriAI/litellm/security/advisories/GHSA-hhww-mrg2-969h"},{"@type":"CreativeWork","url":"https://github.com/BerriAI/litellm/pull/27498"},{"@type":"CreativeWork","url":"https://github.com/BerriAI/litellm/commit/13a193367f0ae2e7e8b29913e0d23a32d3bb0457"},{"@type":"CreativeWork","url":"https://github.com/BerriAI/litellm/releases/tag/v1.85.0"}]}`. An IdP-returned string field containing `` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.\n\n### Impact\n\nReflected XSS on the LiteLLM proxy origin. The route required no authentication, s","url":"https://o3.security/vulnerability/GHSA-hhww-mrg2-969h","identifier":"GHSA-hhww-mrg2-969h","datePublished":"2026-10-27T15:31:56Z","dateModified":"2026-10-27T15:47:24.395753522Z","inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","keywords":["GHSA-hhww-mrg2-969h","MEDIUM severity","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true,"citation":[{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/GHSA-hhww-mrg2-969h"}],"variableMeasured":[{"@type":"PropertyValue","name":"CVSS Base Score","value":6.8,"description":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},{"@type":"PropertyValue","name":"Severity","value":"MEDIUM"}]}`. An IdP-returned string field containing `` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.\n\n### Impact\n\nReflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim "}},{"@type":"Question","name":"How severe is GHSA-hhww-mrg2-969h?","acceptedAnswer":{"@type":"Answer","text":"GHSA-hhww-mrg2-969h has a CVSS score of 6.8/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance."}},{"@type":"Question","name":"Which packages are affected by GHSA-hhww-mrg2-969h?","acceptedAnswer":{"@type":"Answer","text":"GHSA-hhww-mrg2-969h affects the following packages: litellm (PyPI). Ecosystems affected: PyPI."}},{"@type":"Question","name":"How do I fix GHSA-hhww-mrg2-969h?","acceptedAnswer":{"@type":"Answer","text":"Update litellm to 1.85.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hhww-mrg2-969h is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect GHSA-hhww-mrg2-969h in my PyPI dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for litellm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate GHSA-hhww-mrg2-969h if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page."}},{"@type":"Question","name":"Is GHSA-hhww-mrg2-969h actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-hhww-mrg2-969h yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"When was GHSA-hhww-mrg2-969h published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-hhww-mrg2-969h was published on October 27, 2026 and was last updated on October 27, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}
Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
MEDIUM severity

LiteLLM vulnerable to reflected XSS in /sso/debug/callbackGHSA-hhww-mrg2-969h

MEDIUMFix: BerriAI/litellm#27498

GHSA-hhww-mrg2-969h is a medium-severity (CVSS 6.8) vulnerability in litellm. A fix is available for litellm — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 27, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍litellm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The /sso/debug/callback endpoint reflected identity-provider-controlled fields into an inline <script> block via json.dumps, which escapes JSON string syntax but not HTML context characters such as </script>. An IdP-returned string field containing </script> (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin.

Impact

Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim could complete the SSO flow themselves and deliver the resulting callback URL to a logged-in proxy admin. Scripts executing in the proxy origin can read the dashboard session cookie and act with the victim's privileges, up to full admin account takeover.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIlitellm≥ 1.65.5&&< 1.85.01.85.0pip install --upgrade 'litellm==1.85.0'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for litellm, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update litellm to 1.85.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hhww-mrg2-969h is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary The `/sso/debug/callback` endpoint reflected identity-provider-controlled fields into an inline `<script>` block via `json.dumps`, which escapes JSON string syntax but not HTML context characters such as `</script>`. An IdP-returned string field containing `</script>` (for example a user-editable display name) closed the script block and executed attacker JavaScript in the proxy's origin. ### Impact Reflected XSS on the LiteLLM proxy origin. The route required no authentication, so an attacker with an account on the configured IdP whose claims pass such strings through verbatim
O3 Security · Impact-Aware SCA

Is GHSA-hhww-mrg2-969h in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
LiteLLM vulnerable to reflected XSS in /sso/debug/callback