Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10267Information Disclosure in transformeroptimus/superagi

High 7.5

In plain English

A high-severity security flaw in transformeroptimus/superagi from transformeroptimus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all information associated with the existing account. The vulnerable endpoint is located in the user registration functionality.

Affected products (as reported)

Vendor	Product	Versions
transformeroptimus	transformeroptimus/superagi	unspecified – through latest

Weakness: CWE-359 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://huntr.com/bounties/13da8366-4670-4d46-9f5a-ba3f642b692e