CVE-2026-12772 is a security vulnerability affecting BerriAI litellm up to version 1.82.2. It resides in the authenticate_user function within the litellm/proxy/auth/login_utils.py file, part of the PROXY_ADMIN database API Key Generator component. The vulnerability allows remote attackers to manipulate the function to cause session expiration. The flaw has been publicly disclosed with exploit code available, but no official fix or mitigation has been announced by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation results in session expiration, which could disrupt legitimate user sessions and potentially cause denial of service to authenticated users. The impact is limited to session management and does not indicate direct compromise of data confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No vendor-provided mitigation or workaround is currently available.