{"id":"ECHO-b229-8fda-451c","summary":"The vulnerable OIDC userinfo cache (token[:20] as cache key) was\nintroduced in v1.80.8 via commit 4d13035.\nOur package is v1.78.0, which predates this feature entirely.\nThe true affected range is \u003e= 1.80.8, \u003c 1.83.0.\nhttps://github.com/BerriAI/litellm/security/advisories/GHSA-jjhc-v7c2-5hh6\nhttps://github.com/BerriAI/litellm/commit/4d13035bf9153efb34466336d63d1aa4489a6252\n","modified":"2026-09-15T03:33:45.923538397Z","published":"2026-05-05T18:23:31.854575Z","withdrawn":"2026-05-03T07:30:04.185Z","upstream":["CVE-2026-35030","GHSA-jjhc-v7c2-5hh6"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-35030"}],"affected":[{"package":{"name":"litellm","ecosystem":"Echo:PyPI","purl":"pkg:pypi/litellm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+echo.1"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-b229-8fda-451c.json"}}],"schema_version":"1.9.0"}