OpenLIT 2.1.0 contains an authorization bypass flaw that allows an authenticated user to read telemetry from any project by submitting a forged x-openlit-project-id header. The vulnerability permits disclosure of sensitive LLM prompts and completions that belong to other projects. It is a classic privilege escalation scenario classified under CWE‑639.

The flaw affects OpenLIT version 2.1.0. No other versions or products are listed as affected.

The CVSS score of 6 indicates medium severity and the EPSS score is not available. The flaw is not listed in CISA KEV but the impact is still significant because an attacker only needs to be authenticated and to know the target project ID and database configuration ID. The likely attack vector is a crafted HTTP request to the trace read API, and the risk is that leaked telemetry could compromise confidentiality and potentially lead to further exploitation.