Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.

A critical authorization vulnerability exists in Helicone's VaultManager.getDecryptedProviderKeyById() function exposed via the GET /v1/vault/key/{providerKeyId} endpoint. The function fails to validate that the requesting user's organization matches the organization associated with the vault key being accessed. This allows any attacker holding admin or owner privileges in any organization to retrieve decrypted API credentials belonging to other tenants. Exposed credentials include plaintext API keys for major AI providers such as OpenAI, Anthropic, and Amazon Bedrock. The flaw represents a broken object-level authorization (BOLA/IDOR) issue in a multi-tenant SaaS environment. A fix has been committed to the Helicone GitHub repository and the issue has been publicly tracked. The vulnerability poses significant supply-chain and data breach risks given the sensitivity of exposed AI provider credentials.