Preface: LiteLLM is widely deployed by AI platforms because it provides a free, open-source proxy that unifies access to over 100 LLMs (like OpenAI, Anthropic, and local models) under a single OpenAI-compatible API format. It simplifies multi-model integration while enabling enterprise-grade cost tracking, spend limits, and rate limiting.
Background: LiteLLM (BerriAI) uses user_api_key_auth[.]py to handle backend API key validation, user tracking, and model permission routing. To implement custom authentication, you write a Python script with a user_api_key_auth(request, api_key) function and pass the file path to your proxy configuration.
About Auth Workflow When a request arrives at the proxy, the workflow follows these steps:
Request Interception: The proxy receives the HTTP request (e.g., /v1/chat/completions) and inspects the Authorization: Bearer <api_key> header.
Custom Verification: LiteLLM runs the user_api_key_auth function defined in your custom script. This function checks the <api_key> against an external database, a hardcoded master key, or a third-party auth service.
Pydantic Object Return: On success, your function returns a UserAPIKeyAuth Pydantic object (which tracks user limits, key max budgets, and allowed models).
Policy Enforcement: If configured, the proxy enforces rate limits, model allowlists, and per-model spending budgets before passing the request to the LLM provider
Ref: A Pydantic object return refers to configuring a Python function, API framework, or AI framework to output structured data in the form of a validated Pydantic model instance.
Security Advisory: CVE-2026-12773 (LiteLLM Proxy Auth Bypass)
- The Issue: Versions of BerriAI LiteLLM up to 1.59.8 contain a weakness in the custom proxy authentication handler. If post-custom checks are disabled, broken custom scripts can lead to financial and structural compromise via key theft or cross-environment token reuse.
- The Impact: Attackers can bypass request controls, map backend routes, and orchestrate Denial of Wallet (DoW) attacks by draining upstream AI balances.
Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-12773