AutoGPT CVE-2026-55237

Exploitation requires (1) a victim who is already authenticated to a vulnerable AutoGPT instance prior to version 0.6.62, (2) the victim to click an attacker-crafted link to the AutoGPT /signup page that carries a malicious next query parameter, and (3) network reachability from the victim's browser to the AutoGPT front-end. Limiting factors per the CVSS vector: user interaction is required (UI:R), so no automated mass exploitation is possible without social engineering; AutoGPT deployments fronted by a CSP that forbids javascript: navigation, or by a proxy that rewrites the next parameter, materially reduce exploitability; instances at 0.6.62 or later are not affected.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L yields 8.8 largely because of the scope change (script running in the user's session can reach data outside the vulnerable component) and the network attack vector, but it materially depends on UI:R - the victim must click an attacker-supplied link while authenticated to AutoGPT. The vulnerability is not listed in CISA KEV, no EPSS score was supplied, and no public exploit was identified at time of analysis, so this is a credible but not actively-exploited issue. Realistic priority is moderate-to-high for organizations running AutoGPT with multiple authenticated operators (phishing surface is real and stored session tokens or workflow secrets are valuable), and lower for single-user/internal deployments behind SSO that strips suspicious query parameters.

An attacker sends a phishing message containing a link to the AutoGPT signup page with a malicious next parameter (for example a javascript: URI or an attacker-controlled URL that loads a payload). When an authenticated AutoGPT user opens the link in their browser, router.push honors the attacker-supplied value and the payload executes in the AutoGPT origin, allowing the attacker to exfiltrate session tokens, read workflow configurations, or invoke AutoGPT API actions as the victim.