CVE-2026-48710 (BadHost): How a Malformed Host Header Bypasses Starlette Path Authorization

Technical analysis of CVE-2026-48710 (BadHost), a Host header parsing flaw in Starlette that lets attackers bypass path-based authorization, including affected versions, the LiteLLM exploitation chain and remediation steps.