Description

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T21:17:26.260Z",
  "pubdate": "2026-09-04T21:17:26.260Z",
  "executiveSummary": "The vulnerability identified in ramon-victor freegpt-webui, specifically within the ChatCompletion.create function, represents a critical security deficiency categorized as missing authentication.\nThis flaw allows unauthorized remote actors to interface with the application's core functionality without satisfying necessary security access controls.\nThe vulnerability resides within the Authentication Check component, effectively bypassing the expected validation layer for service interaction.\nThe impact includes unauthorized access to the underlying LLM integration, potential abuse of API quotas, and exposure of backend services that depend on the freegpt-webui interface.\nThe risk is exacerbated by the public availability of exploits, making the system an immediate target for automated scanning and abuse.\nAffected systems include all iterations of the repository up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.\nThe product utilizes a rolling release delivery model, and because this vulnerability is specific to unsupported legacy codebases, automated updates may not be available for the affected instances.",
  "technicalDetails": "The vulnerability is situated within the g4f/__init__.py file, specifically affecting the ChatCompletion.create function. The root cause is a failure to enforce authentication or authorization headers when processing requests initiated through the service's interface.\nIn typical deployment scenarios, the ChatCompletion.create function is intended to mediate between the user input and the connected large language model providers. By omitting the authentication check, the function transitions into a state where it accepts and processes requests from unauthenticated remote sources.\nThe attack flow commences with a remote actor crafting a request payload targeting the public-facing endpoint associated with the ChatCompletion.create function. Because the component responsible for authentication validation in g4f/__init__.py does not verify the identity of the requester or the presence of a valid session token, the application proceeds to execute the request.\nThe payload behaves by directly invoking the service's API bridge, causing the backend to transmit the malicious or unsolicited prompt to the configured AI model provider. This effectively turns the vulnerable instance of freegpt-webui into an open proxy or gateway for interacting with third-party LLM APIs.\nThere are no requirements for valid credentials or escalated privileges; the flaw resides in the architectural decision to omit access control verification before the logic execution phase in the code. Consequently, network-exposed instances are susceptible to remote exploitation via standard HTTP requests.\nPost-exploitation impact involves the unauthorized consumption of third-party API resources linked to the server instance. Depending on the configuration of the g4f provider modules, an attacker could exhaust credit balances, violate terms of service with model providers, or exfiltrate sensitive system configurations if the interface allows for further environment interaction.\nThis vulnerability is restricted to legacy, unsupported versions of the software. The lack of proactive authentication enforcement within the module ensures that any public-facing installation prior to the specified commit remains fully exploitable without requiring bypass techniques, as the security mechanism is absent rather than weak."
}