Executive brief
LiteLLM is a proxy service that manages API key authentication and session management for language model deployments. A flaw in the admin login flow generates permanent database API keys and embeds them unencrypted in session cookies, allowing attackers who intercept a login cookie to extract a standalone admin credential that persists long after the session ends. Additionally, the system fails to expire previous keys, causing them to accumulate indefinitely.
Technical details
The vulnerability exists in litellm/proxy/auth/login_utils.py within the authenticate_user() function. During admin and user login, the code calls generate_key_helper_fn() to create a permanent PROXY_ADMIN database API key (sk-...), embeds it unencrypted in the JWT cookie payload under the "key" field, and fails to expire previous keys. An attacker can intercept the login JWT, decode it without a secret (base64), extract the embedded database key, and use it as a standalone bearer token with full admin privileges—independent of the JWT session expiration. This is a session management regression: the previous expire_previous_ui_session_tokens() function was removed during a JWT migration. No patch has been released as of the advisory date; the vulnerability affects all versions up to and including 1.82.2.
Affected products
- BerriAI LiteLLM <= 1.82.2
Timeline
- 2026-06-21: disclosed
- other: Exploit proof-of-concept released publicly