This vulnerability in BerriAI litellm up to version 1.82.2 involves the manipulation of the get_redirect_response_from_openid function within the SSO Authentication Flow component. The issue leads to session expiration, potentially disrupting user sessions. The attack can be performed remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch has been disclosed, and the vendor has been contacted early about the issue. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild.

The vulnerability allows remote attackers to cause session expiration, which may disrupt authenticated sessions and impact user experience or availability of the service. There is no indication of privilege escalation, data disclosure, or system compromise from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, monitor vendor communications for updates. Until a patch is available, consider limiting exposure of the affected endpoints or applying additional access controls if feasible.