This vulnerability in BerriAI litellm up to version 1.82.2 allows improper authorization due to a flaw in the M2M JWT Handler's user API key authentication mechanism. The issue is located in the file litellm/proxy/auth/user_api_key_auth.py. An attacker with low privileges could potentially exploit this remotely, but the attack complexity is high and exploitability is difficult. Although an exploit is publicly available, there is no vendor-provided patch or official remediation guidance at this time.

The vulnerability could allow an attacker to bypass proper authorization controls remotely, potentially gaining unauthorized access or actions within the affected component. However, the low CVSS score and high complexity indicate limited impact and difficulty in exploitation. There are no confirmed exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific temporary mitigations are documented.