CVE-2026-5632 Details

A vulnerability exists in Assafelovic GPT-Researcher versions through 3.4.3, where all HTTP REST API endpoints and the WebSocket interface are exposed without any authentication or authorization. This flaw allows any unauthenticated user to access critical functions such as file uploads and deletions, research task generation, report access, and chat interactions. The vulnerability arises because the FastAPI application does not implement authentication middleware or authorization checks, leaving 14 endpoints accessible to any network user.

Users are advised to implement API key authentication middleware on all sensitive routes, require valid tokens for WebSocket connections, and add rate limiting to research task requests. Additionally, the application should be configured to bind only to localhost by default, remove the static '/outputs/' mount, and include a security warning in the README about the lack of built-in authentication.