Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-5000 EUVD-2026-16929GHSA-wwwf-53m5-vmfq

PromtEngineer localGPT API Endpoint server.py LocalGPTHandler missing authentication

Published Mar 28, 2026 · Updated Apr 1, 2026 · Assigned by VulDB

Vendor: PromtEngineer Product: localGPT

Description

A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054. Impacted is the function LocalGPTHandler of the file backend/server.py of the component API Endpoint. The manipulation of the argument BaseHTTPRequestHandler results in missing authentication. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

VendorProductAffectedFixed
PromtEngineer localGPT 4d41c7d1713b16b216d8e062e51a5dd88b20b054 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References