This vulnerability affects BerriAI litellm up to version 1.82.2 in the SSO Debug Flow component. The issue arises from missing authentication checks in the json.dumps function of the ui_sso.py file, allowing remote attackers to manipulate the system and bypass authentication. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. The vendor was contacted early about the disclosure, but no official fix or mitigation has been announced. Exploits have been publicly disclosed, though no known exploitation in the wild has been reported.

An attacker can remotely exploit this vulnerability to bypass authentication mechanisms in the SSO Debug Flow of BerriAI litellm, potentially gaining unauthorized access to functionality or data that should be protected. The vulnerability does not require privileges or user interaction to exploit, increasing its risk. However, the impact is rated medium, reflecting limited scope or complexity of the attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by the vendor, users should monitor for updates from BerriAI. Until a patch is available, consider restricting access to the affected management endpoints or implementing additional authentication controls around the SSO Debug Flow component if possible.