CVE-2026-12771: BerriAI litellm M2M JWT Authorization Bypass (CVSS 5.0)

Technical summary

CVE-2026-12771 is an improper authorization vulnerability (CWE-266, CWE-285) affecting litellm versions up to 1.82.2. The flaw resides in litellm/proxy/auth/user_api_key_auth.py within the M2M JWT Handler component. An attacker with valid user credentials (PR:L) can craft malformed or manipulated JWT tokens to circumvent authorization logic, potentially accessing resources or capabilities they should not have. The high attack complexity and requirement for prior authentication limit casual exploitation, but the public availability of exploit material increases practical risk.

Business impact

For organizations using litellm in production, this vulnerability could allow authenticated service-to-service requests to exceed their intended permissions. In multi-tenant or heavily delegated proxy environments, this may lead to data exposure between organizational units or services, privilege escalation within integrated LLM workflows, or unauthorized consumption of API resources. The impact is mitigated by the requirement for valid credentials and the complexity of exploitation, but should be prioritized in environments where litellm mediates access to sensitive models or data.

Affected systems

BerriAI litellm versions 1.82.2 and earlier are affected. This includes any deployment relying on the M2M JWT authentication pathway for service-to-service LLM access. Check your installed version immediately; patched versions should be verified against the vendor's official release notes.

Exploitability

Exploitation requires valid user credentials and knowledge of JWT manipulation or the proxy's authentication flow. The attacker must send crafted requests to the affected endpoint, making this a targeted attack rather than a worm-like threat. The CVSS vector (AC:H, PR:L) reflects high attack complexity and low privilege requirements. While public exploits exist, they are not trivial to execute without understanding the target's specific litellm deployment and JWT configuration.

Remediation

Upgrade to a version of litellm that addresses this vulnerability—verify the patched version number against BerriAI's official security advisory. During the interim, restrict access to litellm proxy endpoints to trusted internal services only, implement strict network segmentation, and monitor JWT token usage for anomalies. Consider temporarily disabling M2M authentication if alternative access methods are available.

Patch guidance

Contact BerriAI or consult their official GitHub releases and security advisories for the patched version number and deployment instructions. Ensure you test the upgrade in a staging environment before rolling out to production, as authentication changes may affect dependent services. Verify that all M2M JWT consumers are compatible with the patched version before production rollout.

Detection guidance

Monitor litellm proxy logs for failed authorization attempts or repeated requests from the same authenticated user to resources outside their expected scope. Look for JWT tokens with unusual claims, missing standard fields, or timestamps that appear manipulated. Enable audit logging on the litellm proxy and correlate with upstream LLM API calls to identify unexpected access patterns. Network-based detection is difficult; focus on application-level logging and JWT validation failures.

Why prioritize this

This vulnerability merits prompt but not emergency response. The CVSS score of 5.0 (MEDIUM) reflects real but constrained risk: exploitation requires valid credentials and high technical skill, and impact is limited to confidentiality and integrity of individual components rather than system-wide compromise. However, the public availability of exploit code and the central role of proxy authentication in multi-tenant LLM deployments justify prioritizing this within the next 2–4 weeks alongside other medium-severity patches.

Risk score, explained

The CVSS 3.1 score of 5.0 (MEDIUM) is driven by attack complexity (High), privilege requirements (Low), and lack of user interaction. Confidentiality, integrity, and availability impact are each rated as Low, because a successful bypass grants selective unauthorized access rather than complete system takeover. The remote, unauthenticated attack surface is avoided because PR:L requires the attacker to hold valid credentials, which significantly reduces the threat population.

Frequently asked questions