What’s Vulnerable › Vulnerabilities

CVE-2026-12771: BerriAI litellm M2M JWT user_api_key_auth.py improper authorization

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-06-21 · updated 2026-10-25
• Weakness: CWE-266

Description

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Affected products

• BerriAI litellm: before 1.82.3 — fixed in 1.82.3

How to fix

Upgrade to a fixed version: BerriAI litellm 1.82.3. Check the vendor advisory for mitigations.

References

• https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d
• https://vuldb.com/cve/CVE-2026-12771
• https://vuldb.com/submit/811280
• https://vuldb.com/vuln/372513
• https://vuldb.com/vuln/372513/cti

Get alerted when CVE-2026-12771 or the next vulnerability affects your stack