The flaw resides in the database query that validates the proxy API key. The query concatenates the caller‑supplied key directly into the SQL text, a classic SQL injection weakness (CWE‑89). An attacker can send a specially crafted Authorization header to any LLM API route handled by the proxy, triggering the vulnerable query. Successful exploitation allows the attacker to read records from the proxy’s database and, in some cases, modify or delete them, thereby gaining unauthorized control over the proxy and the credentials it manages.

The vulnerability affects BerriAI's LiteLLM library versions 1.81.16 through 1.83.6. Any deployment that has not applied the patched release 1.83.7 or later is vulnerable. Systems that expose the proxy API to untrusted networks are especially at risk.

This is a critical flaw with a CVSS score of 9.3. The exploitation requires no credentials and relies on a standard HTTP header, making the attack straightforward for an attacker with network access to the proxy endpoint. The EPSS score of 54% indicates a high probability of exploitation, and the vulnerability is listed in CISA KEV. Successful exploitation leads to full read/write control over the proxy’s database and the stored API keys.