A missing authentication check was discovered in the HTTP REST API endpoint of the assafelovic:gpt-researcher component. The flaw allows an attacker to invoke an undeclared function without providing credentials, enabling unauthorized use of the API and potentially exposing sensitive data or control over the system. The weakness corresponds to CWE‑287 and CWE‑306 and represents a moderate severity issue, as quantified by a CVSS score of 6.9.

Systems that run assafelovic:gpt-researcher versions up to 3.4.3 are vulnerable. The vulnerability affects any deployment of the component where the malicious function is exposed through the REST interface, regardless of the host environment or operating system.

The CVSS score of 6.9 indicates moderate risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered remotely via the HTTP interface, it is likely that attackers can exploit it from the public internet once the vulnerable instance is reachable. Public proof‑of‑concept code has already been released, but the project maintainer has not issued a patch or issued a response, increasing the window of exposure.