CVE-2026-12771: BerriAI LiteLLM improper authorization in M2M JWT Handler

CVE-2026-12771 · Severity: medium · CVSS 5 · Published 2026-06-21

LiteLLM is an open-source proxy for managing LLM API access and user authentication. A flaw in its M2M JWT authentication handler allows a holder of a JWT token with admin scope to bypass intended route restrictions and access administrative management endpoints (user/team/key creation and deletion), granting full control over the proxy that should only be available through SSO-authenticated admin sessions. An attacker with a valid admin JWT can create users, teams, and API keys, potentially leading to unauthorized access and privilege escalation.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12771 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12771 being exploited in the wild.
How severe is CVE-2026-12771?
Medium severity, with a CVSS score of 5, published 21 June 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.82.2, up to 1.82.2; litellm (PyPI) ECOSYSTEM:introduced=0,last_affected=1.82.2.
Is there a fix for CVE-2026-12771?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12771 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12771?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in litellm/proxy/auth/user_api_key_auth.py where the JWT M2M authentication path (lines 673-852) lacks the route-guard protection that was previously applied to the OAuth2 M2M path. While OAuth2 M2M authentication correctly restricts token validation to LLM API routes and info routes via RouteChecks guards, the JWT authentication path applies to all routes without restriction. When a JWT token bearing the litellm_proxy_admin scope is presented, the auth handler returns a UserAPIKeyAuth object with PROXY_ADMIN role for any route, including protected management endpoints like /user/new, /team/new, /key/generate, and /key/delete. The attack requires a valid JWT token with admin scope from a configured JWKS endpoint, but requires only network access—no additional authentication or user interaction is needed beyond possessing the token. The vulnerability allows remote, unauthenticated M2M token holders to fully bypass UI SSO separation and gain administrative control over the proxy.

Affected products

  • BerriAI LiteLLM <= 1.82.2

Identifiers

  • CVE-2026-12771
  • GHSA-qmf3-4767-5fg3
  • PYSEC-2026-4075

Timeline

  • 2026-06-21: disclosed
  • 2026-06-21: advisory: GitHub Security Advisory published
  • 2026-09-10: other: GitHub reviewed and confirmed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.