diff --git a/ui/litellm-dashboard/src/app/login/LoginPage.tsx b/ui/litellm-dashboard/src/app/login/LoginPage.tsx
index 178b6769a3c..45e08d4e5ec 100644
--- a/ui/litellm-dashboard/src/app/login/LoginPage.tsx
+++ b/ui/litellm-dashboard/src/app/login/LoginPage.tsx
@@ -47,10 +47,11 @@ function LoginPageContent() {
     // Exchange it for the JWT via the worker's /v3/login/exchange endpoint.
     const params = new URLSearchParams(window.location.search);
     const ssoCode = params.get("code");
-    // Validate code format: only allow alphanumeric + common OAuth code characters.
+    // Validate code format: only allow alphanumeric + common OAuth code characters
+    // (including '=' for base64-padded authorization codes).
     // This prevents arbitrary user input from controlling subsequent logic and
     // satisfies CodeQL's user-controlled-bypass check.
-    const isValidSsoCode = ssoCode != null && /^[a-zA-Z0-9._~+\/-]{1,512}$/.test(ssoCode);
+    const isValidSsoCode = ssoCode != null && /^[a-zA-Z0-9._~+=\/-]{1,512}$/.test(ssoCode);
     if (isValidSsoCode) {
       const workerUrl = localStorage.getItem("litellm_worker_url");
       exchangeLoginCode(ssoCode, workerUrl).then(() => {