Helicone AI Gateway - Authentication Bypass via Default Configuration

[CVE-Hunter-Leo]

Basic Information

• Project: https://github.com/Helicone/ai-gateway
• Vulnerability Type: Authentication Bypass via Default Configuration
• Severity: Critical (CVSS 9.1)
• Affected Versions: All versions up to the latest as of 2026-06-01 (v0.2.0-beta.30)
• CWE: CWE-306 (Missing Authentication for Critical Function)

📍 Location

• ai-gateway/src/config/helicone.rs:14-16
• ai-gateway/src/middleware/auth.rs:123-126

🔍 Vulnerability Description

Under the default configuration, the Helicone AI Gateway completely disables authentication. The HeliconeFeatures enum defaults to None (ai-gateway/src/config/helicone.rs:14-16), which causes the authentication middleware (ai-gateway/src/middleware/auth.rs:123-126) to immediately bypass all checks with if app_state.0.config.helicone.is_auth_disabled() { return Ok(next.run(req).await); }.
As a result, any unauthenticated attacker can send requests to any proxied endpoint (e.g. /ai/v1/chat/completions, /v1/embeddings, /router/*) without providing an API key or token. The gateway will forward these requests using the victim's configured backend LLM provider API keys (OpenAI, Anthropic, AWS Bedrock, Google Gemini, etc.).

// helicone.rs:14-16
#[default]
None,  // ⚠️ Default = No authentication!
/// **Note:** this means no authentication checks, so any request to the
/// gateway will be able to use your provider API keys!

// auth.rs:123-126
if app_state.0.config.helicone.is_auth_disabled() {
    tracing::trace!("auth middleware: auth disabled");
    return Ok(request);  // ⚠️ Bypass all checks
}

💥 Impact

1. Unauthorized access to all LLM providers (OpenAI, Anthropic, AWS Bedrock, Google Gemini, etc.)
2. Provider API key exposure — Attackers can freely use the victim's provider keys
3. Cost abuse — Unlimited usage can result in massive bills
4. Data leakage — Full access to all routes and cached data

🎯 PoC

# No authentication required
curl http://victim-gateway:8080/ai/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-4o",
    "messages": [{"role": "user", "content": "Hello"}]
  }'
# ✅ Returns successful response using the victim's OPENAI_API_KEY

✅ Remediation

// 1. Change the default value
#[derive(Default, ...)]
pub enum HeliconeFeatures {
    #[default]
    Auth,  // ✅ Authentication enabled by default
    // ...
}

// 2. Add validation with warning
impl HeliconeConfig {
    pub fn validate(&self) -> Result<(), ConfigError> {
        if self.features == HeliconeFeatures::None {
            return Err(ConfigError::InsecureDefault(
                "Authentication is disabled! Set features to 'auth' or higher."
            ));
        }
        Ok(())
    }
}