{"id":"CVE-2025-41023","state":"PUBLISHED","title":"Authentication bypass in AutoGPT de Thesamur","description":"An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once inside the web application, the attacker can use any of its features regardless of the authorisation method used.","publishedAt":"2026-02-19T08:50:36.880Z","updatedAt":"2026-02-23T18:33:12.573Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","source":"INCIBE"},"assigner":"INCIBE","products":["Thesamur AutoGPT"],"affected":[{"vendor":"Thesamur","product":"AutoGPT","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/authentication-bypass-autogpt-de-thesamur"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/41xxx/CVE-2025-41023.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-41023","state":"PUBLISHED","datePublished":"2026-02-19T08:50:36.880Z","dateUpdated":"2026-02-23T18:33:12.573Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2025-04-16T09:09:25.290Z"},"containers":{"cna":{"title":"Authentication bypass in AutoGPT de Thesamur","descriptions":[{"lang":"en","value":"An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once inside the web application, the attacker can use any of its features regardless of the authorisation method used."}],"affected":[{"vendor":"Thesamur","product":"AutoGPT","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/authentication-bypass-autogpt-de-thesamur"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"CWE-287 Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2026-02-19T08:50:36.880Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:thesamur:autogpt:all_versions:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Gonzalo Aguilar García (6h4ack)"}],"datePublic":"2026-02-19T08:47:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"No solution has been reported at this time.<br>"}],"value":"No solution has been reported at this time."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-23T18:32:46.680436Z","id":"CVE-2025-41023","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-23T18:33:12.573Z"}}]}}}