GitHub Advisoryadvisory · PyPI

GHSA-mf52-j94g-746m LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration

LOW Published 2026-06-21 Modified 2026-09-10 Official page ↗
Aliases
CVE-2026-12772
Ecosystem
PyPI
Packages
litellm
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-613
Reviewed
2026-09-10

Affected packages

• PyPI litellm: <= 1.82.2 (no fix yet)

Description

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2026-12772 A security flaw has been discovered in BerriAI litellm up to 1.82.2. vulnerability

References