fix(auth): deny wildcard model access for unrecognized provider prefixes

litellm/proxy/auth/auth_checks.py

@@ -4384,12 +4384,21 @@ def _model_custom_llm_provider_matches_wildcard_pattern(model: str, allowed_mode
     - `allowed_model_pattern=anthropic/*`
     """
     try:
-        model, custom_llm_provider, _, _ = get_llm_provider(model=model)
+        resolved_model, custom_llm_provider, _, _ = get_llm_provider(model=model)
     except Exception:
         return False
 
+    # Only infer a provider for a bare model name (e.g. "gpt-4o" -> "openai/gpt-4o").
+    # When get_llm_provider cannot strip an explicit provider prefix (e.g. an
+    # unrecognized "bedrockz/...") it leaves the prefix on the resolved model while
+    # still guessing a provider ("bedrock"), so re-prefixing would build a bogus
+    # "bedrock/bedrockz/..." that spuriously matches "bedrock/*" and grant access to
+    # a model the key/team is not allowed to call.
+    if "/" in resolved_model:
+        return False
+
     return is_model_allowed_by_pattern(
-        model=f"{custom_llm_provider}/{model}",
+        model=f"{custom_llm_provider}/{resolved_model}",
         allowed_model_pattern=allowed_model_pattern,
     )
 

tests/test_litellm/proxy/auth/test_auth_checks.py

@@ -4413,3 +4413,41 @@ async def _spend_by_counter(counter_key, fallback_spend, max_budget=None, **kwar
                 request=MagicMock(spec=Request),
             )
     assert "User=u1" in str(over.value)
+
+
+@pytest.mark.parametrize(
+    "model, allowed_models, expected",
+    [
+        # bare model name resolves its provider and matches a provider wildcard
+        ("gpt-4", ["openai/*"], True),
+        # explicit, correct provider prefix matches
+        ("bedrock/anthropic.claude-3-5-sonnet-20240620", ["bedrock/*"], True),
+        # explicit but WRONG provider prefix must NOT match, even though
+        # get_llm_provider loosely resolves "bedrockz/..." to the "bedrock" provider
+        ("bedrockz/anthropic.claude-3-5-sonnet-20240620", ["bedrock/*"], False),
+        ("openaiz/gpt-4o-mini", ["openai/*"], False),
+        # sub-pattern precision is preserved
+        ("bedrock/claude-3-5-sonnet-20240620", ["bedrock/claude-*"], True),
+        ("bedrock/claude-3-6-sonnet-20240620", ["bedrock/claude-3-5-*"], False),
+    ],
+)
+def test_model_matches_any_wildcard_pattern_in_list_respects_provider_prefix(
+    model, allowed_models, expected
+):
+    """
+    A wildcard like "bedrock/*" must not grant access to a different, unrecognized
+    provider prefix such as "bedrockz/...". get_llm_provider loosely resolves
+    "bedrockz/..." to the "bedrock" provider without stripping the prefix, so the
+    provider-inference matcher must skip re-prefixing an already-prefixed model to
+    avoid a "bedrock/bedrockz/..." string that spuriously matches "bedrock/*".
+    """
+    from litellm.proxy.auth.auth_checks import (
+        _model_matches_any_wildcard_pattern_in_list,
+    )
+
+    assert (
+        _model_matches_any_wildcard_pattern_in_list(
+            model=model, allowed_model_list=allowed_models
+        )
+        is expected
+    )