How severe is CVE-2024-8954?

CVE-2024-8954 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-8954 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-8954?

CVE-2024-8954 affects Composio. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-8954?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2024-8954 have an EU (EUVD) identifier?

Yes. CVE-2024-8954 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6881.

When was CVE-2024-8954 published?

CVE-2024-8954 was published on 2025-03-20 and last updated on 2026-06-17.

CVE-2024-8954

CVE-2024-8954 is a critical-severity vulnerability in Composio with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-304.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-6881
Weakness: CWE-304
Affected product: Composio
Published: 2025-03-20
Last modified: 2026-06-17

Description

In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server.

Frequently asked questions

What is CVE-2024-8954?: In composiohq/composio version 0.5.10, the API does not validate the `x-api-key` header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the `x-api-key` header, thereby gaining unauthorized access to the server.
How severe is CVE-2024-8954?: CVE-2024-8954 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-8954 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-8954?: CVE-2024-8954 affects Composio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-8954?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-8954 have an EU (EUVD) identifier?: Yes. CVE-2024-8954 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-6881.
When was CVE-2024-8954 published?: CVE-2024-8954 was published on 2025-03-20 and last updated on 2026-06-17.

References

https://huntr.com/bounties/f1e0fdce-00d7-4261-a466-923062800b12

Affected products (1)

cpe:2.3:a:composio:composio:0.5.10:*:*:*:*:*:*:*

More vulnerabilities in Composio

CVE-2024-8958 — Critical (CVSS 9.8): In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools…
CVE-2024-8953 — Critical (CVSS 9.8): In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform…
CVE-2025-56427 — High (CVSS 7.5): Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via…
CVE-2024-8955 — High (CVSS 7.5): A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability…
CVE-2024-8952 — High (CVSS 7.5): A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the…
CVE-2024-53526 — Medium (CVSS 6.4): composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the…

All CVEs affecting Composio →

Other CWE-304 vulnerabilities

CVE-2024-2172 — Critical (CVSS 9.8): The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to…
CVE-2024-45764 — Critical (CVSS 9.0): Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability.…
CVE-2026-42452 — High (CVSS 8.1): Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to…
CVE-2025-24322 — High (CVSS 8.1): An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6…
CVE-2024-9216 — High (CVSS 8.1): An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to…
CVE-2024-11302 — High (CVSS 8.0): A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14,…

Browse all CWE-304 vulnerabilities →