CVE-2026-12772
published 2026-06-21CVE-2026-12772: A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py…
PriorityP345medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
0.26%
17.5th percentile
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| berriai | litellm | — | — |
| berriai | litellm | — | — |
| berriai | litellm | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| litellm | litellm | < 1.82.3 | 1.82.3 |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| rhoai | odh-trustyai-garak-lls-provider-dsp-rhel9 | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
litellm: BerriAI litellm: Session expiration leading to denial of service
vendor_redhat·2026-06-21·CVSS 6.3
CVE-2026-12772 [MEDIUM] CWE-826 litellm: BerriAI litellm: Session expiration leading to denial of service
litellm: BerriAI litellm: Session expiration leading to denial of service
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
A flaw was found in BerriAI litellm. A remote attacker could exploit a vulnerability in the `authenticate_user` function within the PROXY_ADMIN database API Key Generator component. By performing a specific manipulation, an attacker can cause session expiration for users, leading to a
GHSA
A security flaw has been discovered in BerriAI litellm up to 1.82.2.
ghsa_unreviewed·2026-06-21
CVE-2026-12772 [LOW] CWE-613 A security flaw has been discovered in BerriAI litellm up to 1.82.2.
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
VulDB
BerriAI litellm up to 1.82.2 PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
vuldb·2026-06-20
CVE-2026-12772 [CRITICAL] BerriAI litellm up to 1.82.2 PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
A vulnerability, which was classified as critical, has been found in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration.
This vulnerability was named CVE-2026-12772. The attack may be initiated remotely. In addition, an exploit is available.
The vendor was contacted early about this disclosure.
No detection rules found.
No public exploits indexed.
2026-06-21
Published