TI-2025-00528 Aliases CVE-2025-0628 GHSA-fjcf-3j3r-78rp

Improper Authorization in BerriAI/litellm

HIGH 70CWE-266Published 2025-03-20 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation, Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-266 and CWE-285.

Summary

An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application, including endpoints such as '/users/list' and '/users/get_users'. This vulnerability allows for privilege escalation within the application, enabling any account to become a PROXY ADMIN.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00344 28th percentileScored 2026-11-07

Fix Fixed berriai/litellm (berriai): v1.61.15-nightlylitellm (PyPI): 1.61.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BerriAI	berriai/litellm	before v1.61.15-nightly	v1.61.15-nightly	Patch available	CNA
—	litellm (PyPI)	before 1.61.15	1.61.15	Patch available	GHSA-fjcf-3j3r-78rp

berriai/litellm VendorBerriAI Affected before v1.61.15-nightly Fixed in v1.61.15-nightly Patch available CNA
litellm (PyPI) Vendor— Affected before 1.61.15 Fixed in 1.61.15 Patch available GHSA-fjcf-3j3r-78rp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:litellm:litellm::::::::	—	—	BerriAI

cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* Versions — — ·BerriAI

Remediation

Fix · CNA berriai/litellm (berriai) Fixed in v1.61.15-nightly
Fix · GHSA-fjcf-3j3r-78rp litellm (PyPI) Fixed in 1.61.15 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-0628
2026-10-03 Alias added: GHSA-fjcf-3j3r-78rp

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-0628

Other 3

TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
TI-2026-30582 LiteLLM: Authenticated command execution via MCP stdio test endpoints KEVCVSS 4.0HIGH 8.7
TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
TI-2024-03969 Remote Code Execution in berriai/litellm CVSS 3.0CRITICAL 9.8

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences