LiteLLM, a proxy server for LLM APIs, reuses a single cryptographic context for at‑rest secrets and session tokens between versions 1.87.0 and 1.104.0‑rc.2. An authenticated internal user can therefore craft metadata that contains a forged administrator credential encrypted with the reused context. When this ciphertext is replayed as a bearer token, the proxy mistakenly trusts the forged administrator identity, granting administrative access and the ability to execute arbitrary commands through the MCP stdio endpoint. This flaw is a high‑impact privilege escalation vulnerability (CWE‑269, CWE‑345, CWE‑441).

BerriAI LiteLLM is affected. All releases from 1.87.0 through 1.104.0‑rc.2 are vulnerable. The flaw exists in default configuration for versions after 1.91.0, while versions 1.87.0 to 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled for exploitation to be possible. The vulnerability was addressed in releases 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0‑rc.2.

The CVSS score of 9.9 indicates a critical severity, and although the EPSS score is not available, the lack of a KEV listing does not diminish the seriousness of the flaw. The attack vector requires an authenticated internal user to craft and replay a forged credential; it does not rely on external network access. Once exploited, the attacker gains full administrative rights and can run arbitrary commands, potentially compromising the entire environment.