Product
LiteLLM versions prior to 1.83.14 allow an authenticated internal user to create API keys that bypass role-based access controls, potentially leading to full privilege escalation to proxy_admin due to a lack of verification of specified routes within the user's own permissions (CVE-2026-47101).