CVE-2025-0330
Last modified
CVE-2025-0330 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all requests.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Litellm | Litellm | 1.52.1 |
References
- https://huntr.com/bounties/661b388a-44d8-4ad5-862b-4dc5b80be30aExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-0330?
How severe is CVE-2025-0330?
How do I fix CVE-2025-0330?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-0321The ElementsKit Pro plugin for WordPress is vulnerable to DO…5.4
- CVE-2025-0324The VAPIX Device Configuration framework allowed a privilege…8.8
- CVE-2025-0325A Guard Tour VAPIX API parameter allowed the use of arbitrar…4.3
- CVE-2025-0327CWE-269: Improper Privilege Management vulnerability exists …8.5
- CVE-2025-0328A vulnerability, which was classified as critical, has been …7.3
- CVE-2025-0329The AI ChatBot for WordPress WordPress plugin before 6.2.4 …4.8
- CVE-2025-0331A vulnerability, which was classified as critical, has been …6.9
- CVE-2025-0332In Progress® Telerik® UI for WinForms, versions prior to 202…9.8
- CVE-2025-0333A vulnerability, which was classified as critical, was found…8.8
- CVE-2025-0334A vulnerability has been found in leiyuxi cy-fast 1.0 and cl…8.8
- CVE-2025-0335A vulnerability was found in code-projects Online Bike Renta…9.8
- CVE-2025-0336A vulnerability was found in Codezips Project Management Sys…9.8
Are you affected by CVE-2025-0330?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST