CVE-2026-5632
Published: 06 April 2026
Summary
CVE-2026-5632 is a high-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as APIs and Models.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly identifies and rejects unauthorized actions without identification or authentication on the vulnerable HTTP REST API endpoint.
Enforces approved authorizations for access to the API endpoint, mitigating the missing authentication vulnerability.
Monitors and controls communications at system boundaries to restrict remote access to the unauthenticated API endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on public-facing HTTP REST API endpoint (CWE-287/306) directly enables remote exploitation without credentials or interaction, mapping to T1190 Exploit Public-Facing Application.
NVD Description
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has…
more
been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Deeper analysisAI
CVE-2026-5632 is a missing authentication vulnerability affecting versions of assafelovic/gpt-researcher up to 3.4.3. The issue resides in an unknown function within the HTTP REST API endpoint, classified under CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers require no privileges or user interaction to exploit this vulnerability by manipulating the affected endpoint. Successful exploitation grants low-level impacts on confidentiality, integrity, and availability, potentially allowing unauthorized access or disruption of the API's functions.
Advisories from VulDB (vuln/355420) note that the project was informed early via GitHub issue #1695 but has not responded or issued patches. No mitigations or fixes are currently available; practitioners should restrict network access to the HTTP REST API endpoint until resolution.
The exploit is publicly available, increasing the risk of immediate abuse. As an AI-powered research tool leveraging GPT models, this vulnerability may expose sensitive research workflows in deployments.
Details
- CWE(s)
AI Security AnalysisAI
- AI Category
- APIs and Models
- Risk Domain
- N/A
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: gpt