CVE-2024-9418 Information

Description

In version 0.0.14 of transformeroptimus/superagi the API endpoint /api/users/get/id returns the user’s password in plaintext. This vulnerability allows an attacker to retrieve the password of another user leading to potential account takeover.

Reference

https://huntr.com/bounties/9a8118a2-ea32-41f5-b501-fef4f31d8213