CVE-2026-85701

Received Received - Intake

Authentication Bypass in FreeGPT WebUI

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-85701

Affected Vendors & Products

Vendor	Product	Version / Range
ramon-victor	freegpt-webui	to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in the freegpt-webui software where the ChatCompletion.create function lacks proper authentication checks in the file g4f/__init__.py. This allows remote attackers to bypass authentication and potentially access unauthorized functionality.

Detection Guidance

This vulnerability involves missing authentication in the ChatCompletion.create function of g4f/__init__.py in freegpt-webui. Detection requires checking for unauthenticated API requests to the affected component. Monitor network traffic for requests to the ChatCompletion endpoint without valid authentication headers or tokens. Inspect logs for unusual access patterns to the g4f/__init__.py file or related endpoints.

Impact Analysis

An attacker could exploit this to perform actions without authentication, potentially accessing sensitive data or system functions. Since the product is no longer supported, there are no official patches available.

Compliance Impact

The vulnerability allows remote unauthorized access due to missing authentication in the freegpt-webui component. This could potentially lead to unauthorized data access or disclosure, which may violate GDPR principles of data protection and user rights or HIPAA requirements for safeguarding protected health information.

Mitigation Strategies

Immediately discontinue use of the affected freegpt-webui software as it is no longer supported and contains a missing authentication vulnerability. Remove or isolate the component from your network to prevent remote exploitation.

Hi! I’m here to help you understand CVE-2026-85701. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70