CVE-2025-14546: litellm Improper Authorization

Vulnerability summary

CVE-2025-14546 is a medium (CVSS 6.9) Improper Authorization vulnerability in litellm. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.1% of scored vulnerabilities.

Timeline

1. 19-12-2025
   PublishedVulnerability first disclosed.
2. 19-12-2025
   Last modifiedVulnerability information updated.

Description

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.