BiiTts/CVE-2026-49468-LiteLLM-Auth-Bypass

PoC

CVE-2026-49468 — LiteLLM (<1.84.0) unauthenticated auth bypass via Host-header route confusion. PoC + docker lab.

view exploit source poc_in_githubauthor BiiTtspublished 2026-07-03catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-49468US	critical9.8	3.03% (87th)	Exploit	2026-06-22
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditi…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.