[Bug]: Editting a key in the UI clears its user_id via /key/update (vuln?)

[xmcp]

What happened?

Step to reproduce:

• Log in as an internal user
• Create a key via "Virtual Keys" -> "+ Create New Key"
• Click on the edit button to bring up the modal, and then click on "Edit Key" to save
• Refresh the page
• Observe that the key is not shown in the "Virtual Keys" table anymore
• The user can still make requests with this key, and the spend won't be linked to that user anymore

After carelessly inspecting the code, the problem might be that when /key/update is called without the user_id field, it will be reset to null in prepare_key_update_data.

This might be a vulnerability but I will just post it here since it is too trivial for anyone to find.

Relevant log output

N/A

Are you a ML Ops Team?

Yes

What LiteLLM version are you on ?

v1.60.2

Twitter / LinkedIn details

No response

[xmcp]

Wait I found that there is no need to even call /key/update. The /key/generate already sets user_id to null. Is this the expected behavior?