repository icon
berriai / litellm Project repository

Python SDK, Proxy Server (LLM Gateway) to call 100+ LLM APIs in OpenAI format - [Bedrock, Azure, OpenAI, VertexAI, Cohere, Anthropic, Sagemaker, HuggingFace, Replicate, Groq]

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN50 DAYS

FIX

WITHIN77 DAYS

API2:2023 Broken Authentication - Admin TakeOver
7h3h4ckv157
pending
Leakage of API key in `api_base` logging in berriai/litellm
manouchehri
pending
Privilege Escalation from Viewer to Admin (Full Control)
rootx120
duplicate
High
Logging into webui as view only internal user provides overly privileged bearer...
williambenembarek
High
•$750•CVE-2025-0628
Leakage of Langfuse API keys in team exception handling
manouchehri
High
•$750•CVE-2025-0330
Unauthorized users can upload files, thereby causing DOS consumption of CPU reso...
startr4ck
informative
High
Local File Read (LFI) via SQL Injection in /key/block endpoint
shadia0
informative
High
Unauth Denial of service
oicu0619
duplicate
High
Unauth DOS on litellm
oicu0619
High
•$750•CVE-2024-10188
Leakage of API key in `api_base` logging
manouchehri
High
•$750•CVE-2024-9606
low privilege(View Only) user can change high privilege user password
oicu0619
informative
Medium
Unauthenticated Denial of Service (DoS) via Multipart Boundary
mnqazi
High
•$750•CVE-2024-8984
Remote Code Execution
mvlttt
High
•$750•CVE-2024-6825
Email HTML Injection
mohammedbenhelli
self closed
SSRF Exposes OpenAI API Keys
lambdasawa
High
•$750•CVE-2024-6587
LiteLLMs Admin Database Key Exposed on Admin.litellm.ai
aunchers
self closed
Frameable response (potential Clickjacking)
mnqazi
informative
Medium
Billion laughs vulnerability that leads to DOS
0xanis
informative
High
Remote code exection base on using eval unsafe
trongphuc12
Critical
•$1500•CVE-2024-5751
SQL Injection through api_key
codevigilanteofficial
Medium
•$125•CVE-2024-5225
Arbitrary file delete
codevigilanteofficial
Medium
•$125•CVE-2024-4888
Improper access control-allow view any organization/budget info
fewword
informative
Low
Improper access control allows for brute-forcing keys
fewword
informative
Medium
Improper access control in team management
fewword
Medium
•$125•CVE-2024-5710
Command injection in ghcr_deploy
kr3ww
informative
High
Code Injection
mvlttt
High
•$750•CVE-2024-4889
Remote Code Execution due to using eval function unsafe
trongphuc12
Critical
•$1500•CVE-2024-4264
Blind SQL Injection
mvlttt
Medium
•$125•CVE-2024-4890
Insecure JSON Web Tokens
saimanikanta1992
informative
Low
Server-Side Template Injection in /completions endpoint
mvlttt
Critical
•$1500•CVE-2024-2952
Admin Account Takeover Via Hardcoded JWT Secret Key
pinkdraconian
self closed
token leak allow to make valid operation
ranjit-git
spam