A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. (CVE-2026-85701)

CVE-2026-85701 is a vulnerability in ramon-victor freegpt-webui affecting the ChatCompletion.create function within the g4f/__init__.py file's Authentication Check component. The vulnerability results in missing authentication, allowing remote attackers to bypass authentication mechanisms. The product is delivered via a rolling release system, so no explicit version numbers for affected or fixed releases are provided. The vulnerability impacts only unsupported versions of the software. The CVSS v3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, but integrity impact is low. No patch or remediation details are available, and no known exploits have been observed in the wild.

The vulnerability allows remote attackers to bypass authentication checks in the affected function, potentially leading to unauthorized actions that impact the integrity of the system. There is no impact on confidentiality or availability. The medium CVSS score reflects the moderate risk due to ease of exploitation and the integrity impact.

No official patch or remediation is currently available. The vulnerability affects only unsupported versions of the product. Users should consider upgrading to supported versions or alternative solutions maintained by the vendor. Monitor the vendor's advisory channels for any future updates or fixes. Since no patch information is provided, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.