Is there a public PoC exploit available for CVE-2026-12772?

Yes, a public proof-of-concept exploit is available for CVE-2026-12772. Prioritise patching immediately. EPSS: 0.2%.

LiteLLM CVE-2026-12772

Q: What is the CVSS score of CVE-2026-12772?

CVE-2026-12772 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38138 LOW

Insufficient Session Expiration (CWE-613)

2026-06-21 VulDB

GHSA-mf52-j94g-746m

Information Disclosure Litellm Berriai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable but requires low-privilege token; session expiration flaw yields limited credential reuse impact with no availability disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:29 vuln.today

Severity Changed

Jun 21, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on litellm (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.82.2.

DescriptionCVE.org

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

AnalysisAI

Insufficient session expiration in LiteLLM's proxy authentication layer (versions 1.82.0 through 1.82.2) allows remote low-privileged users to reuse or manipulate session tokens generated by the PROXY_ADMIN API Key Generator beyond their intended validity window. The flaw resides in the authenticate_user function within litellm/proxy/auth/login_utils.py, where session/API key lifecycle management does not enforce expiration correctly per CWE-613. A public proof-of-concept exploit exists (GitHub gist), though no active exploitation has been confirmed via CISA KEV. The CVSS 4.0 score of 2.1 reflects a limited real-world blast radius despite the network-accessible attack vector.

Technical ContextAI

LiteLLM (cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source LLM proxy and SDK aggregator maintained by BerriAI that provides a unified interface to multiple large language model providers. The affected component - the PROXY_ADMIN database API Key Generator - is responsible for issuing and managing authentication tokens for proxy consumers and administrators. The root cause is CWE-613 (Insufficient Session Expiration): the authenticate_user function in litellm/proxy/auth/login_utils.py fails to enforce proper session/token invalidation, either not revoking keys upon logout/rotation or allowing manipulation of token state to prevent expiration. This class of flaw is particularly sensitive in an LLM proxy context because persistent tokens can be used to issue downstream LLM API calls, potentially exposing API billing accounts, model routing configurations, and request/response logs to unauthorized parties.

RemediationAI

No vendor-released patched version has been independently confirmed in the available data - the affected range is listed through 1.82.2 with no upper-bound fix version specified in CPE or advisory references. Users should monitor the BerriAI LiteLLM GitHub repository and PyPI releases for a patch targeting this issue. In the interim, operators should enforce explicit API key rotation policies and manually revoke all active session tokens via the LiteLLM admin interface. Restricting access to the PROXY_ADMIN API Key Generator endpoint to trusted internal networks or VPN-only traffic using a reverse proxy or firewall rule reduces exposure, though this does not eliminate the underlying flaw. Enabling short-lived token TTLs if configurable in the deployment, and auditing existing API keys for anomalous reuse patterns, are also practical compensating controls. References: VulDB advisory at https://vuldb.com/vuln/372514 and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12772.