SEC.co
Emergency

By weakness (CWE)

CWE-303: related vulnerabilities

CVEs classified under CWE-303. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-12773HIGH 7.3

    BerriAI's litellm library contains an authentication bypass vulnerability in its MCP (Model Context Protocol) Proxy component. The UserAPIKeyAuth function fails to properly validate API keys, allowing remote attackers to bypass authentication controls without requiring credentials or special privileges. This affects litellm versions up to 1.59.8. Because the vulnerability is network-accessible and the exploit code is publicly available, organizations using affected versions face immediate risk of unauthorized access to their LLM proxy infrastructure.