CVE-2026-12771
published 2026-06-21CVE-2026-12771: A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the…
PriorityP354high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.29%
20.5th percentile
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| berriai | litellm | — | — |
| berriai | litellm | — | — |
| berriai | litellm | — | — |
| litellm | litellm | < 1.82.3 | 1.82.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.01.3LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.04.6MEDIUMAV:N/AC:H/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A vulnerability was identified in BerriAI litellm up to 1.82.2.
ghsa_unreviewed·2026-06-21
CVE-2026-12771 [LOW] CWE-266 A vulnerability was identified in BerriAI litellm up to 1.82.2.
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
VulDB
BerriAI litellm up to 1.82.2 M2M JWT user_api_key_auth.py improper authorization
vuldb·2026-06-20
CVE-2026-12771 [CRITICAL] BerriAI litellm up to 1.82.2 M2M JWT user_api_key_auth.py improper authorization
A vulnerability classified as critical was found in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization.
This vulnerability is uniquely identified as CVE-2026-12771. The attack can be launched remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-21
Published