CVE-2026-85701
MediumCVSS 5.3Summary
A vulnerability in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the ChatCompletion.create function in g4f/__init__.py of the Authentication Check component. Manipulation leads to missing authentication. The attack may be performed remotely. The exploit has been disclosed publicly and may be used. This product is no longer supported by the maintainer.
Risk Assessment
Risk of unauthorized access to chat functionality and potential resource abuse, as missing authentication may allow an attacker to perform operations without privileges.
Recommendation
Discontinue use of this product and migrate to a supported solution, as patched versions are unavailable.
Other vulnerabilities in freegpt-webui
See all- CVE-2026-85704Low
In the ramon-victor freegpt-webui project up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc, there is a race condition vulnerability in the getJailbreak function of the file server/config.py in the Jailbreak Mode component. The attack can be launched remotely but requires a high level of complexity and is assessed as difficult to exploit. The exploit has been released. The product uses a rolling release model, so version details are not available. This vulnerability only affects products that are no longer supported by the maintainer.
- CVE-2026-85703Medium
A flaw in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc affects the getJailbreak function in server/backend.py of the Jailbreak Mode component. Manipulation can lead to resource allocation. The attack can be executed remotely. The exploit has been published and may be used. This product is no longer supported by the maintainer.
- CVE-2026-85702High
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. It affects the _conversation function in server/backend.py of the Backend Conversation API. Manipulation of the model argument leads to missing authentication. The attack can be launched remotely. The exploit has been publicly disclosed. This product operates on a rolling release basis, so no version details are available. This vulnerability only affects products no longer supported by the maintainer.
Original NVD description (English source)
A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer.