Helicone's endpoint /v1/vault/key/{providerKeyId} allows an authenticated user with admin or owner level permissions in any organization to retrieve the decrypted upstream provider credentials belonging to another organization. The flaw arises from a missing check that validates the requester's organization against the organization identifier stored with the vault key. A successful exploitation delivers plaintext API keys for services such as OpenAI, Anthropic, and Bedrock, exposing sensitive credentials that could be used for additional attacks, service abuse, or financial loss. The weakness is classified as CWE-639, an authorization bypass that leads to privacy violation by leaking data belonging to a different tenant.

Affected systems are deployments of the Helicone service, specifically the Helicone application. Versions prior to the commit ca34549ea56f7ed587843f82d9cc19baa1f36ba4 contain the unpatched behavior. Users running self‑hosted or cloud‑hosted Helicone instances should verify that the version has been updated to include the patch that enforces the organization filter.

The CVSS score of 8.3 indicates high severity, and while the EPSS score is not available, the lack of a rating does not lower the risk; the vulnerability remains critical because attackers already need elevated privileges to exploit it. KEV is not listed, but the impact on multiple tenants makes prompt remediation essential. Likely attack vectors are privileged insiders or compromised administrator accounts accessing the API; as the flaw requires ownership or admin rights, a broader exploit is unlikely unless those privileges are misused or stolen.