CVE-2024-9418

In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.

Score

CVSS 3.1 6.5 Medium

Status

Modified - security@huntr.dev

Published

2025-03-20

Last modified

2025-10-15

Weaknesses

CWE-256

Affected products

• Superagi (Superagi)
• Transformeroptimussuperagi (Transformeroptimus)

References

• https://huntr.com/bounties/9a8118a2-ea32-41f5-b501-fef4f31d8213