CVE-2025-41023

An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to bypass authentication mechanisms. Once inside the web application, the attacker can use any of its features regardless of the authorisation method used.

Score

CVSS 4.0 6.9 Medium

Status

Deferred - cve-coordination@incibe.es

Published

2026-02-19

Last modified

2026-02-23

Weaknesses

CWE-287

Affected products

• Autogpt (Thesamur)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/authentication-bypass-autogpt-de-thesamur