CVE-2024-10267: SuperAGI Information Disclosure Flaw

CVE-2024-10267 Overview

CVE-2024-10267 is an information disclosure vulnerability in transformeroptimus/superagi version 0.0.14. The user registration endpoint returns full account details when a registration attempt uses an email address that already exists. The response includes the existing user's name, email, and password, enabling account takeover through a single unauthenticated HTTP request. The flaw is classified under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers can harvest stored user credentials, including passwords, by submitting registration requests with known email addresses.

Affected Products

SuperAGI 0.0.14
transformeroptimus/superagi user registration endpoint
Deployments exposing the SuperAGI API over the network

Discovery Timeline

2025-03-20 - CVE-2024-10267 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10267

Vulnerability Analysis

The vulnerability resides in the SuperAGI user registration workflow. When a client submits a registration request containing an email address that is already associated with an account, the server does not return a generic error. Instead, the endpoint responds with the full record of the existing account, including the stored password field.

An attacker with a list of target email addresses can iterate through them and receive credential material for each match. Because the endpoint requires no prior authentication, exploitation reduces to sending crafted HTTP POST requests to the public registration API. The disclosed passwords enable direct authentication to affected SuperAGI instances and any downstream services where users reuse credentials.

Root Cause

The registration handler conflates conflict detection with data retrieval. Rather than returning a minimal 409 Conflict or a sanitized error, the code path serializes the conflicting user object and returns it in the HTTP response body. The response also exposes the stored password field, indicating that credentials are either stored in a reversible form or serialized before hashing checks occur.

Attack Vector

Exploitation requires only network access to the SuperAGI registration endpoint. The attacker submits a POST request containing a target email and arbitrary credentials. If the email exists, the server returns the associated account payload. The attacker parses the response, extracts the password, and authenticates as the victim. See the Huntr Bounty Report for the disclosed proof of concept.

Detection Methods for CVE-2024-10267

Indicators of Compromise

High-volume POST requests to the SuperAGI registration endpoint originating from a single source IP
Registration responses with 2xx or 4xx status codes containing serialized user objects and password fields
Successful logins immediately following bursts of registration attempts against the same accounts
Enumeration patterns cycling through common corporate email formats

Detection Strategies

Inspect application logs for repeated registration attempts targeting existing email addresses
Deploy web application firewall (WAF) rules that flag registration responses exceeding expected payload size
Correlate registration API traffic with subsequent authentication events from the same or related source addresses
Monitor for outbound response bodies containing password field names on registration routes

Monitoring Recommendations

Alert on any HTTP response from the registration endpoint that includes a password key in the JSON body
Track per-IP registration request rates and set thresholds for anomalous enumeration behavior
Retain full request and response captures for the SuperAGI API to support incident review

How to Mitigate CVE-2024-10267

Immediate Actions Required

Restrict network access to the SuperAGI registration endpoint until an upstream patch is applied
Force password resets for all users on affected 0.0.14 deployments
Review authentication logs for unauthorized logins that follow anomalous registration traffic
Rotate any API keys, tokens, or secrets associated with potentially compromised accounts

Patch Information

No vendor advisory or fixed version is listed in the NVD record for CVE-2024-10267. Track the upstream transformeroptimus/superagi repository for a release that removes user data from registration conflict responses. Consult the Huntr Bounty Report for the latest disclosure status.

Workarounds

Place the SuperAGI application behind an authenticating reverse proxy to prevent unauthenticated access to the registration API
Add a WAF rule that strips or blocks response bodies containing password fields on registration routes
Patch the registration handler locally to return a generic conflict error without user data
Store passwords using a one-way hash such as bcrypt or argon2 so leaked fields cannot be reused directly

bash

# Example NGINX rule to block registration responses containing password fields
location /api/user/add-user {
    proxy_pass http://superagi_backend;
    proxy_hide_header Content-Length;
    sub_filter '"password"' '"password_redacted"';
    sub_filter_once off;
    sub_filter_types application/json;
}