A flaw in the authenticate_user function of litellm's PROXY_ADMIN database API Key Generator causes a manipulated session to expire prematurely. The vulnerability is a type of improper session expiration (CWE‑613) and is also a concern of inadequate authorization for protected resources (CWE‑826). It is exploitable remotely through manipulation of input parameters. An attacker can force users to lose active sessions, disrupting service availability and potentially forcing repeated authentication attempts.

The issue affects BerriAI's litellm component up to version 1.82.2. Users running any 1.82.2 or earlier build of litellm should verify whether they are exposed to the vulnerable authenticate_user implementation and plan an upgrade accordingly.

The CVSS score of 5.3 indicates a moderate severity, but the fact that the exploit has been published and can be triggered remotely increases the risk. The EPSS score is <1% and the vulnerability is not listed in CISA KEV. Nonetheless the public availability of the exploit suggests that a motivated attacker could mount the attack without significant additional effort. The overall likelihood of exploitation is non‑zero and the impact would be a denial of service by terminating active user sessions.