CVE-2026-85701: FreeGPT WebUI Auth Bypass Vulnerability

CVE-2026-85701 Overview

CVE-2026-85701 is a missing authentication vulnerability [CWE-287] in the ramon-victor/freegpt-webui project. The flaw resides in the ChatCompletion.create function within g4f/__init__.py, which serves as the Authentication Check component. Attackers can invoke the function remotely without providing valid credentials. The project uses a rolling release model, so no fixed version identifier is published. This vulnerability affects only products no longer supported by the maintainer, and a public exploit has been disclosed.

Critical Impact
Unauthenticated remote attackers can call ChatCompletion.create to consume backend AI provider resources and access chat functionality without authorization.

Affected Products

ramon-victor/freegpt-webui up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc
Component: Authentication Check in g4f/__init__.py
Function: ChatCompletion.create

Discovery Timeline

2026-09-04 - CVE-2026-85701 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85701

Vulnerability Analysis

The vulnerability exists in the ChatCompletion.create function inside g4f/__init__.py. This function acts as the entry point for chat completion requests but does not enforce any authentication check on callers. Remote attackers can invoke chat completion functionality directly over the network. Because the project is a web UI proxying requests to upstream GPT providers, this allows unauthorized use of provider resources tied to the deployment. The maintainer no longer supports the project, so no upstream patch is planned.

Root Cause

The root cause is a missing authentication control [CWE-287] in the ChatCompletion.create code path. The function processes incoming requests without validating any session, API key, or credential token. Any client with network reachability to the service can trigger the workflow.

Attack Vector

Exploitation requires only network access to a vulnerable freegpt-webui instance. The attacker sends a crafted request to the exposed endpoint that calls ChatCompletion.create. No user interaction, prior authentication, or elevated privileges are required. Public exploit details have been disclosed on GitHub Gist and VulDB.

// No verified exploit code included. Refer to the public PoC for technical details:
// [GitHub Gist PoC Repository](https://gist.github.com/Galaxync/4e91898128de8fffbaf893fb1f9d4272)

Detection Methods for CVE-2026-85701

Indicators of Compromise

Unexpected HTTP requests reaching freegpt-webui endpoints that trigger ChatCompletion.create without a valid session cookie or API key header.
Spikes in outbound traffic from the freegpt-webui host to upstream GPT provider APIs.
Anomalous billing or rate-limit events on the upstream AI provider accounts associated with the deployment.

Detection Strategies

Enable HTTP access logging on the freegpt-webui frontend and alert on requests to chat completion routes lacking authentication headers.
Correlate inbound request volume with upstream provider API call volume to detect abuse patterns.
Review commit history and confirm whether the deployed build is at or before commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.

Monitoring Recommendations

Forward web server and reverse proxy logs to a centralized analytics platform for continuous review.
Monitor source IP diversity hitting chat endpoints; a single source generating high request volume is a strong abuse indicator.
Track upstream provider quota consumption and alert on deviations from baseline usage.

How to Mitigate CVE-2026-85701

Immediate Actions Required

Restrict network exposure of freegpt-webui by binding it to localhost or an internal network only.
Place the application behind a reverse proxy that enforces authentication before any request reaches ChatCompletion.create.
Rotate any upstream AI provider API keys used by the deployment if abuse is suspected.

Patch Information

No vendor patch is available. The maintainer no longer supports freegpt-webui, and the project follows a rolling release model without pinned version identifiers. Consider migrating to an actively maintained alternative that implements authentication and authorization controls. See the VulDB CVE-2026-85701 entry for advisory details.

Workarounds

Deploy an authenticating reverse proxy such as NGINX or Traefik with HTTP Basic Auth, OAuth2 Proxy, or mTLS in front of the service.
Apply IP allowlisting via firewall rules to permit access only from trusted networks.
Implement rate limiting on the reverse proxy to reduce the impact of unauthenticated requests if exposure is unavoidable.

bash

# Example NGINX reverse proxy snippet enforcing HTTP Basic Auth
location / {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:1338;
}