CVE-2026-85701: Missing Authentication in ramon-victor freegpt-webui

The vulnerability CVE-2026-85701 affects the ramon-victor freegpt-webui project, specifically the ChatCompletion.create function in the g4f/__init__.py file. Due to missing authentication checks, remote attackers can exploit this flaw to bypass authentication mechanisms. The product is delivered via a rolling release system, so no specific version numbers are provided. The vulnerability affects unsupported versions of the software. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on integrity. Exploit details have been publicly disclosed, but no known exploits are reported in the wild. No vendor advisory or patch information is available.

The vulnerability allows remote attackers to bypass authentication in the affected function, potentially enabling unauthorized access or actions within the freegpt-webui application. The impact is limited to integrity with no reported confidentiality or availability impact. Since the product is no longer supported, users remain exposed unless they upgrade or mitigate by other means.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product is no longer supported by the maintainer, no official fixes are available. Users should consider discontinuing use or migrating to a supported alternative. Implementing external access controls or network-level restrictions may help mitigate exposure.