LiteLLM CVE-2026-12771

Exploitation requires that the LiteLLM proxy instance is configured to use the M2M JWT Handler for machine-to-machine authentication, as the vulnerable code path is specific to litellm/proxy/auth/user_api_key_auth.py and its JWT processing logic. The CVSS PR:L metric confirms that the attacker must possess low-level credentials or an existing authenticated session before exploitation - unauthenticated attacks are not supported by the available vector. The AC:H metric further constrains exploitation, indicating that specific, non-default conditions or precise manipulation of JWT structure is required; the VulDB description characterizes exploitability as 'difficult.' Exploitation is limited to instances where M2M JWT authentication is actively enabled and reachable over the network; deployments that do not use JWT-based service authentication or that isolate the LiteLLM proxy behind internal network boundaries face substantially reduced risk. There is no requirement for user interaction (UI:N), and the attack is network-reachable (AV:N), but the combination of required low privileges and high complexity narrows the realistic attacker population.

The CVSS 4.0 score of 1.3 is very low, driven primarily by AC:H (high attack complexity), PR:L (low privileges required), and uniformly low vulnerable-system impact scores (VC:L/VI:L/VA:L). The E:P supplemental metric confirms a proof-of-concept is available, which ordinarily elevates operational concern, but the high complexity floor substantially constrains opportunistic exploitation. No CISA KEV listing exists, meaning no confirmed widespread active exploitation. The CVSS 4.0 vector indicates no scope change into subsequent systems (SC:N/SI:N/SA:N), bounding the blast radius to the LiteLLM proxy instance itself. From an SSVC perspective: exploitation status is 'PoC' (not active), the attack is not trivially automatable due to AC:H, and technical impact is partial. The real-world risk is therefore low-to-moderate for deployments where the M2M JWT flow is actively used, and low for environments that do not use machine-to-machine JWT authentication. EPSS data is not present in the provided intelligence; that signal is missing and cannot be used to refine the probability estimate. CVSS 4.0 and CVSS 3.1 alignment is consistent on network vector and low privileges, so no scoring conflict is identified.

An attacker with low-level authenticated access to a LiteLLM proxy deployment - for example, a service account credential obtained through credential theft or an insider - crafts a manipulated M2M JWT token that exploits the improper authorization logic in user_api_key_auth.py. Due to the flaw in the JWT handler's authorization decision, the proxy accepts the token as granting elevated or unauthorized permissions, allowing the attacker to issue API calls to proxied LLM backends beyond their intended access scope. A public proof-of-concept on GitHub (https://gist.github.com/YLChen-007/70e4e106527f74ddf17953ff0f6c248d) demonstrates this technique, though the AC:H rating indicates reproduction requires non-trivial conditions.