LiteLLM MCP OAuth2 Authentication Bypass via Passthrough Fallback (CVE-2025-59822) Advisory

Vulnerability Overview Vulnerability Name: MCP Authentication Bypass via OAuth2 Passthrough Fallback Vulnerability ID: GHSA-7488-632-c95q Severity: High (8.8 / 10) CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: None - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Impact Scope Affected Versions: = 1.84.0 Description: - LiteLLM's MCP Streamable HTTP endpoint allows an unauthenticated attacker to establish an authenticated MCP session using a forged Bearer token. - The MCP authentication processor supports OAuth2 passthrough for upstream MCP servers, but the fallback path may replace failed LiteLLM key verification with an empty object. This allows access to MCP tools using a forged header without a valid LiteLLM key. - An attacker can exploit this vulnerability to invoke configured MCP tools and access exposed services connected via MCP. Remediation Patch: - The issue has been fixed in version 1.84.0. - Upgrading to version 1.84.0 or later is recommended. Workaround: - If an immediate upgrade is not possible, disable MCP routes or block access to and related MCP endpoints via a reverse proxy or API gateway. References v1.84.0 Additional Information CVE ID: CVE-2025-59822 Credits: yaaras Reporter: yaaras

Goal Reached Thanks to every supporter — we hit 100%!

LiteLLM MCP OAuth2 Authentication Bypass via Passthrough Fallback (CVE-2025-59822) Advisory

More from this source