A flaw named PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication permits attackers to call the LocalGPT API endpoint without needing credentials. The bug arises from improper handling of the BaseHTTPRequestHandler arguments, allowing the request to bypass authentication checks. As a result, an attacker can retrieve or influence data processed by LocalGPT, potentially accessing sensitive content or injecting malicious requests.

The vulnerability affects the PromtEngineer localGPT product. All releases based on the commit 4d41c7d1713b16b216d8e062e51a5dd88b20b054 or earlier are unpatched. Because the project follows a rolling release model, specific version numbers are not disclosed, meaning that any installed instance that has not applied a fix is susceptible.

The CVSS score of 6.9 indicates medium to high risk, and the absence of an EPSS score leaves uncertainty about exploitation likelihood. The vulnerability is exploitable remotely via the exposed API endpoint, and the lack of authentication allows attackers to execute arbitrary requests or retrieve data. Since the product does not list the CVE in the KEV catalog, it may be less widely exploited, yet the potential impact for compromised accounts remains significant. Prompt attention to patching or mitigation is recommended.