CVE-2026-85701 ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

CVE-2026-85701

ramon-victor freegpt-webui (up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc ) is affected by a missing authentication flaw in the ChatCompletion.create function within g4f/init .py (component: Authentication Check). A remote attacker can manipulate this function without valid credentials, r...

CVE-2026-85701 ramon-victor freegpt-webui Authentication Check __init__.py ChatCompletion.create missing authentication

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

EUVD-2026-71749

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

PT-2026-86260

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

PT-2026-86253

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/ init .py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

CVE-2026-85702: Missing Authentication for Critical Function

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

CVE-2026-85703: Allocation of Resources Without Limits or Throttling

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

CVE-2026-85704: Concurrent Execution using Shared Resource with Improper Synchronization

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the...

PT-2026-86259

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing...

PT-2026-89161

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists where role synchronization fails to invalidate cached user records during a privilege demotion. When an administrator is demoted via a trusted role header or OAuth role...

PT-2026-89159

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.11.0 Description An issue exists in the calendar event model within backend/open webui/models/calendar.py where the meta.alert minutes value is stored without type validation. Because the shared upcoming-eve...

CVE-2026-85701: Missing Authentication for Critical Function

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

PT-2026-86262

CVE-2026-85704: Race condition in Freegpt Webui Jailbreak Mode, server/config.py allows remote attacks, but high complexity makes exploitation difficult. CVSS 3.7. Public exploit exists. No patch available. Update or monitor POC available https://t.co/2oFcukN71V valtersit CVE CVEAlert infosec...

PT-2026-89160

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.11.0 Description An authenticated user can create a parent cycle by placing a folder under itself or one of its descendants. This occurs because the system does not validate that the new parent is not the...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, open-webui, kubeflow-pipelines-visualization-server, py3-nltk, nemo, label-studio, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, open-webui, kubeflow-pipelines-visualization-server, py3-nltk, nemo, label-studio, apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: py3-nltk, kubeflow-pipelines-visualization-server, open-webui...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: py3-nltk, kubeflow-pipelines-visualization-server, open-webui...

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of the WebUI components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...