Freegpt Webui
Monthly
Unthrottled resource allocation in freegpt-webui's getJailbreak function (server/backend.py) enables remote unauthenticated attackers to exhaust server resources via crafted Jailbreak Mode requests (CWE-770). The affected product is an unmaintained hobby GPT wrapper by ramon-victor, pinned to all commits through 098db3dfeb41555c2ca9269df0f13e10ec1c35dc with no patched release forthcoming. A public proof-of-concept exploit is available on GitHub, and no vendor fix will be issued as the maintainer has abandoned the project.
Unauthenticated access to the Backend Conversation API in ramon-victor/freegpt-webui allows remote attackers to invoke the `_conversation` function without valid credentials by manipulating the `model` argument in HTTP requests to `server/backend.py`. The affected codebase is a rolling-release hobby project that has been abandoned by its maintainer, meaning no patch will be issued. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation against any instance still running.
Missing authentication in freegpt-webui's ChatCompletion.create function (g4f/__init__.py, up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc) permits unauthenticated remote callers to invoke AI chat completion requests directly against the backend providers without credentials. A public proof-of-concept is available on GitHub. The product is abandoned and no longer maintained, meaning no vendor patch will be issued, and remediation requires decommissioning or layered compensating controls.
Unthrottled resource allocation in freegpt-webui's getJailbreak function (server/backend.py) enables remote unauthenticated attackers to exhaust server resources via crafted Jailbreak Mode requests (CWE-770). The affected product is an unmaintained hobby GPT wrapper by ramon-victor, pinned to all commits through 098db3dfeb41555c2ca9269df0f13e10ec1c35dc with no patched release forthcoming. A public proof-of-concept exploit is available on GitHub, and no vendor fix will be issued as the maintainer has abandoned the project.
Unauthenticated access to the Backend Conversation API in ramon-victor/freegpt-webui allows remote attackers to invoke the `_conversation` function without valid credentials by manipulating the `model` argument in HTTP requests to `server/backend.py`. The affected codebase is a rolling-release hobby project that has been abandoned by its maintainer, meaning no patch will be issued. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation against any instance still running.
Missing authentication in freegpt-webui's ChatCompletion.create function (g4f/__init__.py, up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc) permits unauthenticated remote callers to invoke AI chat completion requests directly against the backend providers without credentials. A public proof-of-concept is available on GitHub. The product is abandoned and no longer maintained, meaning no vendor patch will be issued, and remediation requires decommissioning or layered compensating controls.