From 5d8f74f1c1224014479d6db72e0db26edb2118b1 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 20 May 2026 17:06:32 +0000 Subject: [PATCH] fix(jwt): strip internal _litellm_* claims in global JWKS auth path Prevents identity spoofing where a token signed by the global JWKS could inject _litellm_jwt_issuer and other _litellm_* claims that downstream getters trust. The issuer-scoped path already strips these via _apply_issuer_claim_mappings; mirror that behavior for the global fallback path. Co-authored-by: Yassin Kortam --- litellm/proxy/auth/handle_jwt.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index 957a032da5b..0e2941e3788 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -1064,7 +1064,11 @@ class JWTHandler: issuer=decode_kwargs["issuer"], options=decode_kwargs["options"], ) - return payload + return { + k: v + for k, v in payload.items() + if k not in self.LITELLM_INTERNAL_CLAIMS + } except jwt.ExpiredSignatureError: # the token is expired, do something to refresh it