Insufficient Verification of Data Authenticity Affecting litellm package, versions [1.67.4, 1.100.4)[1.101.0.dev1, 1.101.3)[1.102.0.dev1, 1.102.2)[1.103.0.dev1, 1.103.1)[1.104.0.dev1, 1.104.0rc2)

litellm is a Library to easily interface with LLM API providers

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity allowing privilege escalation, in the key encryption handling, which uses a single encryption key both to seal secrets at rest and to mint session tokens. A user with internal_user privileges can gain proxy_admin access and execute arbitrary commands on the host through the MCP stdio endpoint by requesting a new API key whose metadata field carries a forged admin credential as the secret value, then presenting the returned encrypted payload as a bearer token, which the proxy decrypts and accepts as an admin identity. The affected authentication path is active in the default configuration on current releases and on earlier ones only where EXPERIMENTAL_UI_LOGIN was explicitly enabled.

This vulnerability can be avoided by setting EXPERIMENTAL_UI_LOGIN=false, which disables the affected authentication path at the cost of CLI SSO and Claude Code gateway login.

• GitHub Commit
• GitHub Security Advisory