This vulnerability affects the assafelovic gpt-researcher product up to version 3.4.3. It arises from missing authentication controls on an HTTP REST API endpoint, enabling unauthenticated remote access to certain functionality. The exact impacted function within the API is unknown. The vulnerability was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

An attacker can remotely access and manipulate the affected HTTP REST API endpoint without authentication. This could lead to unauthorized actions depending on the API function impacted. The exact impact is unclear due to unspecified affected functionality, but the medium CVSS score reflects a moderate risk. No known exploits are confirmed in the wild yet, though a public exploit exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the affected API endpoints or implementing external authentication controls if possible.