CVE-2026-12772: BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration
A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticateuser of the file litellm/proxy/auth/loginutils.py of the component PROXYADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the PROXY_ADMIN database API Key Generator (component: litellm/proxy/auth/login_utils.py authenticate_user) until a vendor-provided fix is available.
PROXY_ADMIN database API Key Generator enabled = false - Compensating control
Restrict network access to the authenticate_user function in litellm/proxy/auth/login_utils.py (PROXY_ADMIN database API Key Generator) to trusted IPs or an internal management network only; block or firewall all other remote access to that endpoint.
- Operational
Rotate and revoke all API keys issued by the PROXY_ADMIN database API Key Generator and invalidate active sessions; require re-authentication for affected accounts and applications.
- Operational
Enable increased logging and alerting for calls to litellm/proxy/auth/login_utils.py authenticate_user and for anomalous session expirations; monitor for exploitation indicators and block or firewall IPs that exhibit exploit behavior.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12772?
The severity of CVE-2026-12772 is rated as medium with a score of 6.3.
How do I fix CVE-2026-12772?
To fix CVE-2026-12772, update BerriAI LiteLLM to the latest version that addresses this vulnerability.
What components are affected by CVE-2026-12772?
CVE-2026-12772 affects the function authenticate_user in the file litellm/proxy/auth/login_utils.py of the PROXY_ADMIN database API Key Generator.
What impact does CVE-2026-12772 have if exploited?
Exploiting CVE-2026-12772 may result in unintended session expiration for users authenticated through the affected component.
Is CVE-2026-12772 a remote vulnerability?
Yes, CVE-2026-12772 has a remote attack vector as indicated by the attack vector metric AV:N.