The flaw resides in the async_pre_call_hook function of the banned_keywords module inside the Completions Interface component of BerriAI litellm. By manipulating the prompt argument, an attacker can cause the authorization logic to evaluate incorrectly, potentially granting unauthorized access to the completion service. The description notes that the attack may be performed from remote, and a public exploit has already been released, indicating that the weakness is exploitable through standard network communication with the service. The incorrect authorization could allow an attacker to use the interface beyond intended permissions, affecting data confidentiality and integrity of the supplied content. Additionally, the same flaw can cause an attacker to exploit identity confusion issues identified by CWE-551, potentially leading to multiple users sharing the same authorization context or privileges.

BerriAI:litellm up to and including version 1.82.5. The vulnerability affects all deployments using the enterprise/enterprise_hooks/banned_keywords.py module in these releases.

The CVSS score of 5.3 reflects a moderate severity for denial or partial privilege escalation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. However, the public release of the exploit and the ability to conduct the attack from remote imply that the risk is non‑negligible, especially for environments that rely on the litellm Completions Interface for production workloads.