Is there a public PoC exploit available for CVE-2026-12771?

Yes, a public proof-of-concept exploit is available for CVE-2026-12771. Prioritise patching immediately. EPSS: 0.2%.

LiteLLM CVE-2026-12771

Q: What is the CVSS score of CVE-2026-12771?

CVE-2026-12771 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38137 LOW

Improper Authorization (CWE-285)

2026-06-21 VulDB

GHSA-qmf3-4767-5fg3

Authentication Bypass Litellm Berriai

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.2 MEDIUM

Network-reachable but requires low-privilege credentials and complex JWT manipulation; no availability impact described; scope remains unchanged within the proxy.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:29 vuln.today

CVSS changed

Jun 21, 2026 - 02:22 NVD

2.3 (LOW) 1.3 (LOW)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on litellm (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.82.2.

DescriptionCVE.org

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user_api_key_auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

AnalysisAI

Improper authorization in LiteLLM's M2M JWT Handler (litellm/proxy/auth/user_api_key_auth.py) enables remote attackers holding low-level credentials to bypass authorization controls in versions 1.82.0 through 1.82.2. The flaw resides in the machine-to-machine JWT authentication pathway of the LiteLLM proxy layer, where manipulated JWT inputs cause the handler to make incorrect authorization decisions, potentially granting unauthorized access to proxied LLM API resources. No active exploitation has been confirmed by CISA KEV, though publicly available exploit code exists (GitHub gist by YLChen-007), and the CVSS 4.0 vector carries an E:P temporal modifier reflecting this proof-of-concept availability; overall risk is tempered by high attack complexity.

Technical ContextAI

LiteLLM is an open-source LLM proxy framework (BerriAI) that unifies calls to multiple large language model providers behind a single API gateway. The vulnerable component is the proxy authentication middleware in litellm/proxy/auth/user_api_key_auth.py, specifically the machine-to-machine (M2M) JWT Handler - a code path designed to authenticate non-human service-to-service callers using JSON Web Tokens. CWE-285 (Improper Authorization) identifies the root cause: the handler fails to correctly enforce authorization decisions after or during JWT validation, meaning that a crafted or manipulated token may be accepted as legitimate even when it should be rejected or granted a lesser permission scope. The CPE cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:* covers all LiteLLM application versions reported by EUVD as 1.82.0, 1.82.1, and 1.82.2. This is distinct from a JWT signature bypass; the flaw is in the authorization logic applied after token parsing, consistent with the 'Authentication Bypass' tag.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified in the available intelligence at time of analysis. The EUVD and NVD advisories reference only affected versions (1.82.0-1.82.2) without naming a remediated release. Operators should monitor the BerriAI LiteLLM repository and the VulDB advisory (https://vuldb.com/vuln/372513) for an upstream fix. As a compensating control, deployments should disable or restrict the M2M JWT authentication pathway in the LiteLLM proxy configuration if it is not operationally required - removing the vulnerable code path eliminates the attack surface entirely, with the trade-off of losing service-to-service JWT-based access. Where M2M JWT must remain active, network-layer controls such as restricting access to the LiteLLM proxy endpoint to known internal service IP ranges will reduce exposure, though this does not eliminate the flaw for insider or compromised-service scenarios. Additionally, auditing proxy access logs for anomalous JWT-authenticated requests may provide early detection of exploitation attempts. The public proof-of-concept at https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d should be reviewed to understand exact triggering conditions and inform targeted detection rules.