CVE-2026-12772: Session Expiration Flaw in BerriAI litellm Proxy Authentication

Technical summary

CVE-2026-12772 is a session management vulnerability (CWE-613) in the authenticate_user function within litellm/proxy/auth/login_utils.py. The flaw permits authenticated users to manipulate authentication state, resulting in forced session expiration. The CVSS v3.1 base score of 6.3 reflects the requirement for prior authentication (PR:L), network accessibility (AV:N), low attack complexity (AC:L), and impact across confidentiality, integrity, and availability (C:L/I:L/A:L). No specialized attack complexity is required once an attacker has gained legitimate credentials.

Business impact

Session expiration attacks can disrupt legitimate user workflows, force re-authentication overhead, and degrade user experience for administrators managing proxy infrastructure. While not directly enabling unauthorized data access, the ability to terminate sessions creates opportunities for follow-on attacks, including credential harvesting during forced re-authentication. Organizations relying on litellm for API gateway orchestration should assess continuity of service if authenticated users or compromised accounts exploit this flaw.

Affected systems

BerriAI litellm versions up to 1.82.2 are affected. The vulnerability specifically impacts deployments using the PROXY_ADMIN database API Key Generator component. Any organization running the litellm proxy layer for LLM request routing and authentication should evaluate their version status immediately.

Exploitability

The vulnerability requires valid authentication credentials (PR:L) and network access to the litellm proxy endpoint. Public exploit code is already available, lowering the barrier to weaponization. However, the attacker cannot act without legitimate account access, which somewhat constrains mass-scale exploitation unless account compromise is widespread. The low attack complexity and lack of user interaction requirements (UI:N) mean that once credentials are obtained, exploitation is straightforward.

Remediation

Upgrade litellm to a patched version released after 1.82.2. Verify the exact patched version in the BerriAI litellm release notes or security advisory. In the interim, implement network-level access controls to restrict who can reach the PROXY_ADMIN API endpoint, review and revoke API keys for any users suspected of testing or exploiting this flaw, and monitor authentication logs for unusual session termination patterns.

Patch guidance

Check the BerriAI litellm GitHub repository and official release notes for versions newer than 1.82.2 that address CWE-613 in the authentication layer. Apply patches in a staged manner: test in a non-production proxy environment first, verify that API key generation and session management function correctly post-upgrade, then deploy to production proxy instances. Plan for brief downtime or use a blue-green deployment if running critical LLM routing infrastructure.

Detection guidance

Monitor litellm proxy logs for frequent session terminations or expiration events, especially clustered around specific user accounts or API keys. Search authentication logs (login_utils.py output or audit trails) for repeated calls to authenticate_user with unusual parameter patterns. Alert on any sudden increase in failed session validation or authentication errors. If running intrusion detection, flag network requests to the PROXY_ADMIN API key generator endpoint from unexpected sources.

Why prioritize this

Although the CVSS score is MEDIUM (6.3), the availability of public exploits and the potential for lateral movement via credential harvesting during forced re-authentication warrant prompt patching. The requirement for prior authentication limits impact to insider threats or compromised accounts, but those scenarios are common in real-world breaches. Prioritize patching in environments where litellm proxy is internet-facing or accessible to third-party integrations.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects a bounded-impact scenario: authenticated access required, network-exploitable, no user interaction needed, and partial impact to confidentiality, integrity, and availability. The score does not account for the public availability of exploit code or the potential for chained attacks. Organizations should consider contextual factors—such as whether their litellm proxy is exposed to untrusted networks or whether account compromise is likely—when determining internal risk ratings.

Frequently asked questions