CTE - Cross-Account Access Demo

Inspiration

I came to the Vaani buildathon to build a voice agent. While working with the platform, I discovered that an unrelated API key could access and edit another account's agents. I turned that finding into CTE - Cross-Account Access Demo.

What it does

CTE demonstrates a cross-account authorization flaw using three accounts I own. It shows how access that should be restricted to an agent's owner was possible from a different account, including changes to the agent's system prompt.

How we built it

I used Python, cURL and the Vaani REST API to inspect responses and demonstrate cross-account access between my own accounts. I reported the finding privately to the Vaani team, who are working on a fix.

Challenges we ran into

The main challenge was demonstrating the issue clearly while keeping the demo limited to my own accounts. Another was explaining the difference between having a valid API key and having permission to access a particular agent.

Accomplishments that we're proud of

I identified an authorization issue, created a controlled demo and brought it directly to the team so they could address it.

What we learned

Authentication and authorization are different. A valid API key should not automatically grant access to another account's resources. Ownership and tenant permissions need to be checked on every read and update.

What's next for CTE - Cross-Account Access Demo

The next step is to coordinate with the Vaani team on validating the fix using the same owned test accounts, checking that cross-account requests are rejected while legitimate access still works.

Built With

• curl
• json
• python
• rest-api
• vaani