CVE-2026-12771
published 2026-06-21CVE-2026-12771: A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the…
PriorityP354high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.43%
36.1th percentile
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| berriai | litellm | — | — |
| berriai | litellm | — | — |
| berriai | litellm | — | — |
| litellm | litellm | < 1.82.3 | 1.82.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.01.3LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.04.6MEDIUMAV:N/AC:H/Au:S/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
litellm: Litellm: Improper authorization vulnerability
vendor_redhat·2026-06-21·CVSS 7.5
CVE-2026-12771 [HIGH] CWE-1220 litellm: Litellm: Improper authorization vulnerability
litellm: Litellm: Improper authorization vulnerability
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
A flaw was found in BerriAI litellm. A remote attacker can exploit an improper authorization vulnerability within the M2M JWT Handler. This could allow unauthorized access, leading to a low impact on the confidentiality, integrity, and availability of affected res
GHSA
A vulnerability was identified in BerriAI litellm up to 1.82.2.
ghsa_unreviewed·2026-06-21
CVE-2026-12771 [LOW] CWE-266 A vulnerability was identified in BerriAI litellm up to 1.82.2.
A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
VulDB
BerriAI litellm up to 1.82.2 M2M JWT user_api_key_auth.py improper authorization
vuldb·2026-06-20
CVE-2026-12771 [CRITICAL] BerriAI litellm up to 1.82.2 M2M JWT user_api_key_auth.py improper authorization
A vulnerability classified as critical was found in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization.
This vulnerability is uniquely identified as CVE-2026-12771. The attack can be launched remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure.
No detection rules found.
No public exploits indexed.
2026-06-21
Published