CVE-2024-8954
Authentication Bypass in composiohq/composio
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Authentication Bypass in composiohq/composio
In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server.
Reserved 2024-09-17 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-304 Missing Critical Step in Authentication
huntr.com/bounties/f1e0fdce-00d7-4261-a466-923062800b12
Support options
