CVE-2026-12772: LiteLLM session expiration bypass

CISO Take

CVE-2026-12772 is an insufficient session expiration flaw (CWE-613) in litellm's proxy authentication layer — specifically the PROXY_ADMIN API Key Generator — where an attacker with minimal privileges can manipulate session lifetime and maintain unauthorized persistent access to the LLM proxy long after credentials should have expired. LiteLLM proxy is widely deployed as a unified API gateway in front of OpenAI, Anthropic, Azure OpenAI, and dozens of other LLM providers, meaning a compromised admin proxy session can pivot to any connected inference endpoint and rack up unauthorized charges. While CVSS is 6.3 (medium) and this CVE is not in CISA KEV, the attack complexity is low (AV:N/AC:L), the CVE description explicitly states a public exploit has been released — contradicting the structured 'No public exploit' field, which warrants treating worst-case as true — and the PROXY_ADMIN scope makes success particularly damaging through API key harvesting, cost abuse, and full inference traffic exposure. Patch to litellm >1.82.2 immediately, rotate all PROXY_ADMIN API keys, and audit proxy session logs for anomalously long-lived sessions.

Sources: NVD ATLAS

What is the risk?

Medium CVSS (6.3) but operationally significant in enterprise LLM deployments. The vector AV:N/AC:L/PR:L/UI:N indicates network-accessible, low-complexity exploitation requiring only a low-privilege account — a developer key, basic trial, or any compromised user credential is sufficient entry. The PROXY_ADMIN component is the highest-privilege path in litellm's access model; session persistence here means attackers can outlast credential rotations and access controls. The CVE description asserts a public proof-of-concept exists (contradicting structured metadata — treat as unverified but elevated risk). No CISA KEV listing and EPSS unavailable. Risk is concentrated in organizations running litellm proxy as a shared multi-tenant LLM gateway.

How does the attack unfold?

Initial Access

Attacker authenticates to the litellm proxy with any low-privilege credential — a developer API key, basic account, or trial access is sufficient.

AML.T0012

Session Exploitation

Attacker sends crafted requests to the authenticate_user function in login_utils.py that manipulate session expiration parameters in the PROXY_ADMIN database API Key Generator, obtaining a token with extended or no expiration.

AML.T0049

Persistence

Using the non-expiring session, attacker generates new PROXY_ADMIN API keys to ensure continued access even after the original credential is rotated or revoked.

AML.T0091.000

Impact

Attacker exfiltrates inference traffic (prompts, completions, configurations) across all connected LLM providers and drives unauthorized API usage charged to victim billing accounts.

AML.T0040

Initial Access

Attacker authenticates to the litellm proxy with any low-privilege credential — a developer API key, basic account, or trial access is sufficient.

AML.T0012

Session Exploitation

Attacker sends crafted requests to the authenticate_user function in login_utils.py that manipulate session expiration parameters in the PROXY_ADMIN database API Key Generator, obtaining a token with extended or no expiration.

AML.T0049

Persistence

Using the non-expiring session, attacker generates new PROXY_ADMIN API keys to ensure continued access even after the original credential is rotated or revoked.

AML.T0091.000

Impact

Attacker exfiltrates inference traffic (prompts, completions, configurations) across all connected LLM providers and drives unauthorized API usage charged to victim billing accounts.

AML.T0040

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
55.3K OpenSSF 5.8 6 dependents Pushed 5d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

PATCH

Upgrade litellm to the latest version above 1.82.2 immediately.
ROTATE

Revoke and regenerate all PROXY_ADMIN API keys and active session tokens as a precautionary measure.
AUDIT

Review proxy access logs for anomalously long-lived sessions, unexpected API key generation events, or PROXY_ADMIN activity outside expected change windows.
RESTRICT

If patching is not immediately possible, isolate the litellm proxy admin endpoints behind VPN or internal-only network controls.
MONITOR

Instrument alerts for session durations exceeding configured proxy timeouts and new admin API key generation events.
VERIFY

Confirm server-side session expiration enforcement in your deployment — do not rely solely on client-side token TTL.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Inference API AML.T0012 - Valid Accounts AML.T0034 - Cost Harvesting AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1.4 - AI system security and resilience

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-12772?

CVE-2026-12772 is an insufficient session expiration flaw (CWE-613) in litellm's proxy authentication layer — specifically the PROXY_ADMIN API Key Generator — where an attacker with minimal privileges can manipulate session lifetime and maintain unauthorized persistent access to the LLM proxy long after credentials should have expired. LiteLLM proxy is widely deployed as a unified API gateway in front of OpenAI, Anthropic, Azure OpenAI, and dozens of other LLM providers, meaning a compromised admin proxy session can pivot to any connected inference endpoint and rack up unauthorized charges. While CVSS is 6.3 (medium) and this CVE is not in CISA KEV, the attack complexity is low (AV:N/AC:L), the CVE description explicitly states a public exploit has been released — contradicting the structured 'No public exploit' field, which warrants treating worst-case as true — and the PROXY_ADMIN scope makes success particularly damaging through API key harvesting, cost abuse, and full inference traffic exposure. Patch to litellm >1.82.2 immediately, rotate all PROXY_ADMIN API keys, and audit proxy session logs for anomalously long-lived sessions.

Is CVE-2026-12772 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-12772, increasing the risk of exploitation.

How to fix CVE-2026-12772?

1. PATCH: Upgrade litellm to the latest version above 1.82.2 immediately. 2. ROTATE: Revoke and regenerate all PROXY_ADMIN API keys and active session tokens as a precautionary measure. 3. AUDIT: Review proxy access logs for anomalously long-lived sessions, unexpected API key generation events, or PROXY_ADMIN activity outside expected change windows. 4. RESTRICT: If patching is not immediately possible, isolate the litellm proxy admin endpoints behind VPN or internal-only network controls. 5. MONITOR: Instrument alerts for session durations exceeding configured proxy timeouts and new admin API key generation events. 6. VERIFY: Confirm server-side session expiration enforcement in your deployment — do not rely solely on client-side token TTL.

What systems are affected by CVE-2026-12772?

This vulnerability affects the following AI/ML architecture patterns: LLM proxy and API gateway deployments, Multi-model LLM routing platforms, Enterprise LLM access management layers, LLM inference serving infrastructure.

What is the CVSS score for CVE-2026-12772?

CVE-2026-12772 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

LLM proxy and API gateway deploymentsMulti-model LLM routing platformsEnterprise LLM access management layersLLM inference serving infrastructure

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0034 Cost Harvesting

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate_user of the file litellm/proxy/auth/login_utils.py of the component PROXY_ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

Exploitation Scenario

An adversary targeting an organization's LLM infrastructure identifies a litellm proxy instance accessible to authenticated internal users or via a trial/developer account. Using a low-privilege credential, the attacker sends crafted authentication requests to the authenticate_user function in litellm/proxy/auth/login_utils.py, manipulating the session expiration parameters handled by the PROXY_ADMIN database API Key Generator. The server issues a session token without enforcing proper expiration boundaries, granting the attacker a long-lived or effectively permanent authenticated admin session. Using this persistent session, the attacker enumerates all connected LLM provider API keys and routing configurations, generates new PROXY_ADMIN API keys for durable backdoor access, and silently intercepts or logs all inference traffic — prompts, completions, and model metadata — while unauthorized inference charges accumulate on the victim's billing accounts.

Weaknesses (CWE)

CWE-613 Insufficient Session Expiration Primary CWE-613 Insufficient Session Expiration

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."