PT-2026-30571 · Assafelovic · Assafelovic Gpt-Researcher

Yu-Bao · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5632

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gpt-researcher versions up to 3.4.3

Description gpt-researcher is affected by a missing authentication issue in the HTTP REST API Endpoint. A manipulation of an unknown function within the component allows for bypassing authentication. This can be initiated remotely. A public exploit is available, and the vendor has not responded to reports of the issue.

Recommendations Versions prior to 3.4.4 are recommended.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-5632

Affected Products

Assafelovic Gpt-Researcher

References · 11

• 🔥 https://github.com/assafelovic/gpt-researcher/issues/1695 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5632 · Security Note
• https://vuldb.com/vuln/355420 · Note
• https://twitter.com/DFIR_Lab/status/2041059739832868867 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041054701244867058 · Twitter Post
• https://twitter.com/cyberbivash/status/2041064961435140187 · Twitter Post
• https://twitter.com/cyberbivash/status/2041077643513155913 · Twitter Post
• https://vuldb.com/vuln/355420/cti · Note
• https://github.com/assafelovic/gpt-researcher · Note
• https://vuldb.com/submit/785874 · Note
• https://twitter.com/CVEnew/status/2041054122732933336 · Twitter Post