CVE-2025-0628

🗓️ 20 Mar 2025 10:10:45Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 86 Views🌐 WEB

Improper authorization in BerriAI/litellm grants excessive access to internal user accounts.

Reporter	Title	Published	Views	Family All 14
Huntr	Logging into webui as view only internal user provides overly privileged bearer key	14 Nov 202416:44	–	huntr
Circl	CVE-2025-0628	20 Mar 202512:48	–	circl
CNNVD	LiteLLM 授权问题漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2025-0628 Improper Authorization in BerriAI/litellm	20 Mar 202510:10	–	cvelist
EUVD	EUVD-2025-6827	3 Oct 202520:07	–	euvd
Github Security Blog	LiteLLM Has an Improper Authorization Vulnerability	20 Mar 202512:32	–	github
NVD	CVE-2025-0628	20 Mar 202510:15	–	nvd
OSV	GHSA-FJCF-3J3R-78RP LiteLLM Has an Improper Authorization Vulnerability	20 Mar 202512:32	–	osv
RedhatCVE	CVE-2025-0628	22 Mar 202512:41	–	redhatcve
Snyk	Improper Authorization	20 Mar 202518:43	–	snyk

Vulners

Node

berriai berriai/litellmRange<1.61.15

[
  {
    "vendor": "berriai",
    "product": "berriai/litellm",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "v1.61.15-nightly",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/berriai/litellm/commit/566d9354aab4215091b2e51ad0333e948125fa1b
huntr	www.huntr.com/bounties/6c0e2f75-2d03-42f9-9530-e16a973317fc

Parameter	Position	Path	Description	CWE
api_key	header	/users/list	Admin functionality accessible via leaked API key due to improper authorization.	CWE-266
api_key	header	/users/get_users	Admin functionality accessible via leaked API key due to improper authorization.	CWE-266

15 Apr 2026 00:35Current

8.2High risk

Vulners AI Score8.2

CVSS 38.1

EPSS0.00274

SSVC

CWE-266