CVE-2026-85702: freegpt-webui Authentication Bypass Flaw

CVE-2026-85702 Overview

CVE-2026-85702 is a missing authentication vulnerability [CWE-287] in the ramon-victor/freegpt-webui project. The flaw resides in the _conversation function of server/backend.py, part of the Backend Conversation API. Attackers can manipulate the model argument to reach the API without providing credentials. Because the project follows a rolling release model, no discrete affected or fixed version is enumerated, and the maintainer no longer supports the project. A public proof-of-concept has been disclosed, increasing the likelihood of opportunistic exploitation against exposed deployments.

Critical Impact
Remote, unauthenticated attackers can invoke the Backend Conversation API and abuse hosted freegpt-webui instances, consuming resources and accessing conversational functionality without credentials.

Affected Products

ramon-victor/freegpt-webui (all rolling releases up to and including commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc)
Backend Conversation API component (server/backend.py)
Deployments of freegpt-webui exposed to untrusted networks

Discovery Timeline

2026-09-04 - CVE-2026-85702 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85702

Vulnerability Analysis

The vulnerability affects the _conversation handler in server/backend.py, which processes chat completion requests for the freegpt-webui application. The endpoint does not enforce authentication before executing conversation logic. A remote attacker can craft an HTTP request that manipulates the model parameter and reach backend functionality without providing valid session credentials or API tokens. The result is unauthorized access to the conversation API and any downstream resources it consumes.

The issue is classified as Missing Authentication for Critical Function [CWE-287]. Because freegpt-webui is often deployed as a self-hosted gateway to third-party model providers, unauthenticated access can lead to resource abuse, quota exhaustion, and unwanted operational costs against upstream providers.

Root Cause

The root cause is the absence of an authentication check within the _conversation request handler. Requests to the Backend Conversation API are accepted based solely on well-formed input rather than an authenticated principal. The model argument is processed without a prior identity or authorization decision, allowing anonymous callers to reach code paths that should require a trusted user context.

Attack Vector

Exploitation requires only network reachability to a vulnerable freegpt-webui instance. The attacker sends a crafted request that includes a valid model value to the Backend Conversation API endpoint. No credentials, user interaction, or elevated privileges are required. A public proof-of-concept is available in a GitHub Gist, lowering the barrier to exploitation. Publicly exposed installations, including those on cloud hosts and container platforms, are the most immediate targets.

See the GitHub Gist proof-of-concept and the VulDB CVE-2026-85702 entry for reference material.

Detection Methods for CVE-2026-85702

Indicators of Compromise

Unauthenticated HTTP POST requests to the freegpt-webui /backend-api/v2/conversation endpoint originating from unknown source addresses.
Sudden increases in upstream model provider API usage or unexpected billing spikes tied to a self-hosted freegpt-webui deployment.
Requests containing arbitrary or unexpected values in the model parameter that do not match legitimate user activity.

Detection Strategies

Inspect web server and application logs for conversation API requests that lack session cookies, authentication headers, or valid referrer origins.
Correlate outbound requests from the freegpt-webui host to third-party model providers with inbound anonymous traffic patterns.
Deploy a reverse-proxy access log baseline and alert on request volume anomalies against server/backend.py handler routes.

Monitoring Recommendations

Forward freegpt-webui application and reverse-proxy logs to a centralized log platform for retention and analysis.
Alert on repeated requests from single source IPs targeting the Backend Conversation API endpoint.
Monitor egress connections from freegpt-webui hosts for unexpected destinations and unusual data volumes.

How to Mitigate CVE-2026-85702

Immediate Actions Required

Remove freegpt-webui from public exposure by restricting network access to trusted client ranges only.
Place the application behind an authenticating reverse proxy that enforces credentials before requests reach server/backend.py.
Rotate any upstream model provider API keys used by the deployment to invalidate credentials that may have been abused.
Migrate away from ramon-victor/freegpt-webui where feasible, since the project is no longer supported by the maintainer.

Patch Information

No vendor patch is available. The advisory states that the project operates on a rolling release with no version identifiers, and the vulnerability affects a product that is no longer supported by the maintainer. Users should assume the flaw will remain unfixed upstream and plan compensating controls or migration accordingly. Review the VulDB vulnerability record #398805 for tracking updates.

Workarounds

Enforce authentication in front of the application using a reverse proxy such as NGINX, Traefik, or an identity-aware proxy, requiring valid tokens or SSO before forwarding to freegpt-webui.
Apply network-level access controls with firewall rules or security groups that only allow trusted source addresses to reach the service port.
Add a middleware wrapper that validates a shared secret header on all requests reaching the _conversation handler if source modification is feasible.
Decommission internet-exposed instances and rebuild on a maintained fork or alternative project that enforces authentication by default.

bash

# Example NGINX configuration enforcing HTTP basic authentication
# in front of a freegpt-webui instance listening on 127.0.0.1:1338
server {
    listen 443 ssl;
    server_name freegpt.example.internal;

    location / {
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;

        allow 10.0.0.0/8;
        deny all;

        proxy_pass http://127.0.0.1:1338;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}