CVE-2026-93355 describes a weak authentication vulnerability in BerriAI's LiteLLM product. The issue arises because the JWT authentication flow uses an email-based fallback lookup that does not verify the email_verified claim. An attacker possessing a valid JWT with an unverified email matching a victim's account can authenticate as that user, inheriting their roles including proxy_admin privileges. This allows the attacker to permanently overwrite the victim's stored identity binding, maintaining persistent unauthorized access to administrative endpoints that expose API keys and user management functions.

Attackers can impersonate any existing user by exploiting the lack of email verification in the JWT authentication fallback. This leads to unauthorized privilege escalation to administrative roles, persistent identity binding overwrites, and exposure of sensitive administrative API keys and user management capabilities. The vulnerability poses a high risk to confidentiality and integrity of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict JWT token issuance to trusted identity providers and monitor for suspicious token usage. Avoid relying on email-based fallback lookups without verifying the email_verified claim.