Bind UI/CLI session tokens to their own AES-GCM context
refactor(auth): bind UI/CLI session tokens to their own AES-GCM context
Bind UI/CLI session tokens to their own AES-GCM context9fa1a6-refactor-bind-ui-cli-session-tokens-to-cve-2026-114612refactorbind cli session tokens own aes
Committed by yuneng-berri
commit message
refactor(auth): bind UI/CLI session tokens to their own AES-GCM context
Backport of BerriAI/litellm-private#5 (12981f93d3) onto rc/1.104.0, applied as
the PR's net diff so main-only intermediate refactors stay out.Editor assessment
This commit patches CVE-2026-114612. The RC backport keeps the precise subject and auth scope and explains the net-diff approach, but it is the shortest of the series: no note about omitted OIDC e2e specs and, more importantly, no rationale for the token-binding change. Clean and valid, yet it teaches only that a private fix was ported to the release candidate. The header and scope parse correctly and the body is short but well formed; what a reader cannot get from it is why the change exists, which keeps it at acceptable.