CVE-2026-12772: BerriAI LiteLLM insufficient session expiration in Admin UI login

CVE-2026-12772 · Severity: medium · CVSS 6.3 · Published 2026-06-21

LiteLLM is a proxy service that manages API key authentication and session management for language model deployments. A flaw in the admin login flow generates permanent database API keys and embeds them unencrypted in session cookies, allowing attackers who intercept a login cookie to extract a standalone admin credential that persists long after the session ends. Additionally, the system fails to expire previous keys, causing them to accumulate indefinitely.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12772 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12772 being exploited in the wild.
How severe is CVE-2026-12772?
Medium severity, with a CVSS score of 6.3, published 21 June 2026.
Which products and versions are affected?
Berriai LiteLLM <= 1.82.2; litellm (PyPI) ECOSYSTEM:introduced=0,last_affected=1.82.2.
Is there a fix for CVE-2026-12772?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12772 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12772?
Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in litellm/proxy/auth/login_utils.py within the authenticate_user() function. During admin and user login, the code calls generate_key_helper_fn() to create a permanent PROXY_ADMIN database API key (sk-...), embeds it unencrypted in the JWT cookie payload under the "key" field, and fails to expire previous keys. An attacker can intercept the login JWT, decode it without a secret (base64), extract the embedded database key, and use it as a standalone bearer token with full admin privileges—independent of the JWT session expiration. This is a session management regression: the previous expire_previous_ui_session_tokens() function was removed during a JWT migration. No patch has been released as of the advisory date; the vulnerability affects all versions up to and including 1.82.2.

Affected products

  • BerriAI LiteLLM <= 1.82.2

Identifiers

  • CVE-2026-12772
  • GHSA-mf52-j94g-746m
  • PYSEC-2026-4073

Timeline

  • 2026-06-21: disclosed
  • other: Exploit proof-of-concept released publicly

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.