CVE-2026-55237: AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (next), which is passed to router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. Version 0.6.62 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AutoGPTto a version that resolves this vulnerability.Fixed in 0.6.62
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55237?
CVE-2026-55237 has a high severity rating of 8.8.
How do I fix CVE-2026-55237?
To fix CVE-2026-55237, update AutoGPT to version 0.6.62 or later.
What types of attacks can exploit CVE-2026-55237?
CVE-2026-55237 can be exploited for DOM-based Cross-Site Scripting (XSS) and open redirect attacks.
Which versions of AutoGPT are affected by CVE-2026-55237?
All versions of AutoGPT prior to 0.6.62 are affected by CVE-2026-55237.
What impact does CVE-2026-55237 have on user data?
CVE-2026-55237 can lead to unauthorized access to sensitive information through XSS, affecting user data integrity and confidentiality.