Authentication Bypass in Composio API by ComposioHQ

CVE-2024-8954

What is CVE-2024-8954?

In version 0.5.10 of Composio, the API lacks proper validation for the x-api-key header during the authentication process. This absence of validation enables attackers to bypass normal authentication checks simply by submitting any arbitrary value in the x-api-key header. As a result, an attacker can gain unauthorized access to the server, potentially leading to further exploitation and compromise of sensitive data.

References