In composiohq/composio version 0.5.10, the API does not validate the x-api-key headers value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the x-api-key header, thereby gaining unauthorized access to the server.
Weakness
The product implements an authentication technique, but it skips a step that weakens the technique.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Composio | Composio | 0.5.10 (including) | 0.5.10 (including) |