CVE-2026-5632

CVE-2026-5632 is an authentication bypass vulnerability affecting assafelovic gpt-researcher versions up to 3.4.3, specifically within an undocumented HTTP REST API endpoint. The vulnerability allows unauthenticated remote manipulation of the affected component, potentially exposing sensitive functionality to unauthorized access. The vulnerability carries a CVSS 3.1 score of 7.3 (HIGH) with a network-based attack vector requiring no privileges or user interaction. The attack has low complexity and could result in limited compromise of confidentiality, integrity, and availability. The EPSS score of 0.00105 suggests relatively low exploitation likelihood compared to other vulnerabilities in circulation. Public exploit code is available, indicating active awareness in security communities, though the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no signs of active exploitation campaigns. The development team was notified early through an issue report but has not yet provided a response or security update, leaving affected systems potentially vulnerable pending a patch release.