Lilthawg29

**Name of the Vulnerable Software and Affected Versions** LiteLLM versions prior to 1.84.0 **Description** A Host-header parsing flaw in the LiteLLM proxy allows unauthenticated access to protected management routes. The authentication layer derives the effective route from `request.url.path` in the `get request route()` function within `litellm/proxy/auth/auth utils.py`, which is reconstructed from the `Host` header. A crafted `Host` header can cause the authentication gate to evaluate a different route than the one dispatched by FastAPI, leading to an authentication bypass via Host Header Injection. **Recommendations** Update to version 1.84.0 or later. As a temporary workaround, place the proxy behind an upstream component that validates or normalizes the `Host` header, such as a CDN, WAF, a reverse proxy with explicit `server name` allowlists, or a cloud load balancer with host-based routing rules, or restrict network access to the proxy listener.