A critical authentication bypass vulnerability in BerriAI LiteLLM prior to version 1.84.0 enables unauthenticated remote attackers to gain unauthorized access to the AI gateway.

This vulnerability [CWE-290] exists in the get_request_route() function, where improper validation of request paths allows an unauthenticated attacker to manipulate the Host header. This creates a discrepancy between the authentication layer and the FastAPI routing, permitting unauthorized access to restricted management endpoints.

Successful exploitation allows an unauthorized actor to bypass credential checks, leading to full control or manipulation of the AI proxy server. With a CVSS score of 9.5, this flaw poses a severe risk to confidentiality, integrity, and availability, potentially exposing sensitive downstream AI systems and credentials.

Immediate Action: Update BerriAI LiteLLM to version 1.84.0 or later immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review access logs for anomalous requests featuring unusual Host headers or attempts to access internal management paths.

Compensating Controls: Ensure the LiteLLM proxy is deployed behind a robust upstream CDN, WAF, or reverse proxy configured to strictly validate and sanitize the Host header.

Public Exploit Available: false

Given the critical nature of this authentication bypass, organizations must prioritize patching to version 1.84.0. If immediate patching is not possible, ensure the proxy is not directly exposed to the internet and enforce strict header validation at the network perimeter.