CVE-2026-55237: DOM-Based XSS in AutoGPT Signup Page

Technical summary

The vulnerability exists in AutoGPT's signup page implementation, which uses an unvalidated URL parameter (`next`) directly within a `router.push` call. This is a classic DOM-based XSS pattern (CWE-601) where user-controlled input flows directly to a sink without sanitization. An attacker constructs a URL like `https://autogpt.example.com/signup?next=javascript:malicious_code()` or leverages HTML attribute injection. When an authenticated user follows the link, the JavaScript executes in their browser within the AutoGPT origin, granting the attacker access to session cookies, local storage, and the ability to make authenticated requests. The vector requires user interaction (clicking the link) and network access, but no special privileges—any user can be targeted. The vulnerability also enables credential harvesting through fake login forms injected into the page.

Business impact

This vulnerability creates significant operational and reputational risk. An attacker can impersonate users to modify automation workflows, access sensitive data processed by AI agents, or pivot to internal systems if users have cross-domain access. Compromised credentials could escalate to administrative accounts, allowing wholesale workflow manipulation or data exfiltration. For organizations relying on AutoGPT for critical business processes, this poses both immediate security and continuity risk. Customer trust is also at stake if their data or credentials are exposed through this flaw.

Affected systems

AutoGPT versions prior to 0.6.62 are affected. The vulnerability manifests in the signup page, but any authentication context (including post-signup) could be exploited if the victim has an active session. This impacts all deployments of affected versions, whether self-hosted or cloud-based, as the flaw is in the core application logic.

Exploitability

Exploitability is moderate to high. The attack requires user interaction—clicking a malicious link—which is the primary barrier. However, phishing is a mature attack vector, and social engineering to trick users into clicking is reliable. No authentication bypass is needed; the vulnerability actually requires the victim to already be authenticated. Once clicked, exploitation is deterministic: the JavaScript executes immediately. An attacker does not need special network position or knowledge of the target's configuration. Weaponization is straightforward for someone with JavaScript and URL encoding knowledge.

Remediation

Upgrade AutoGPT to version 0.6.62 or later. This version patches the unsafe handling of the `next` parameter. Organizations should also consider implementing Content Security Policy (CSP) headers to mitigate DOM-based XSS, validate and sanitize all user input before using it in navigation, and use secure redirect functions that whitelist allowed destinations. Additionally, enforce HTTPOnly and Secure flags on session cookies to limit credential theft impact.

Patch guidance

1. Verify your current AutoGPT version. 2. Consult the official AutoGPT release notes and security advisory for version 0.6.62 to confirm patch availability and any upgrade prerequisites. 3. Test the upgrade in a non-production environment first, ensuring backward compatibility with existing workflows. 4. Apply the patch to all AutoGPT deployments, including any isolated or air-gapped instances. 5. Restart the application and validate signup and login flows. 6. Review any custom integrations or proxy configurations that may affect URL parameter handling.

Detection guidance

Monitor for exploitation attempts by inspecting access logs for suspicious `next` parameter values in signup requests—particularly those containing `javascript:`, `data:`, or HTML encoding. Look for encoded or obfuscated JavaScript patterns in URL parameters. Implement browser-side detection: check browser console for unexpected script execution during signup. Review network traffic for redirects to external or unusual domains from the signup flow. Correlate user activity: if a user logs in, then shortly after accesses external or malicious domains, that may indicate exploitation. Consider deploying a Web Application Firewall (WAF) rule to block requests with suspicious `next` parameter payloads.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), the combination of high confidentiality and integrity impact, and the low barrier to exploitation via social engineering. The ability to steal credentials and pivot through an AI agent platform—which may have broad access to business systems—elevates risk. Although it requires user interaction, phishing is common and effective. Organizations using AutoGPT for critical workflows should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-based attack vector with no special access required, (2) Low attack complexity—straightforward URL crafting, (3) User interaction required, but common via phishing, (4) Impact scope changed—the vulnerability affects resources beyond the vulnerable component (entire browser context and integrated systems), (5) High confidentiality impact (credential and data theft), (6) Limited integrity impact (actions performed on victim's behalf), and (7) Minor availability impact (disruption via workflow manipulation). The 'S:C' (scope changed) elevates the score significantly, reflecting cross-domain implications of XSS in a platform managing AI agents.

Frequently asked questions