| Title | ramon-victor (https://github.com/ramon-victor) freegpt-webui latest (main/master branch) CWE-306 (Missing Authentication for Critical Function - endpoint |
|---|
| Description | Authentication Bypass - needs_auth check skipped for model's best_provider - Location: `g4f/__init__.py:9`. The ChatCompletion.create method enforces provider authentication ONLY when a 'provider' argument is explicitly passed by the caller. When no provider is specified (the common path), the code resolves the provider from model.best_provider (line: 'engine = model.best_provider if not provider else provider'), but the needs_auth check is never performed against this resolved provider. This means any model whose best_provider has needs_auth=True (e.g., Model.palm -> Provider.Bard, Model.gpt_4_0613 -> Provider.Lockchat which also needs specific auth) can be invoked without any authentication credentials. The business rule that providers marked needs_auth=True require credentials is completely bypassed on the default code path. Furthermore, the backend API endpoint (_conversation in server/backend.py) never passes a provider argument and never passes an auth argument, so all auth-required providers are reachable unauthenticated through the web API by simply sending the appropriate model name (e.g., 'palm2', 'bard'). Exploitation: 1. An attacker sends POST /backend-api/v2/conversation with JSON body {"model":"palm2", "conversation_id":"x-y", "jailbreak":"default", "meta":{"content":{"conversation":[],"internet_access":false,"parts":[{"role":"user","content":"hello"}]}}}. 2. ChatCompletion.create is called with provider=None and auth=False. 3. The model resolves to Model.palm whose best_provider is Provider.Bard (needs_auth=True). 4. The auth check 'if provider and provider.needs_auth and not auth:' evaluates to 'if None and True and True:' which is False, so the check is skipped entirely. 5. Provider.Bard._create_completion executes, attempting to read browser cookies from the server host and making authenticated requests as if proper auth was supplied.
|
|---|
| Source | ⚠️ https://gist.github.com/Galaxync/4e91898128de8fffbaf893fb1f9d4272 |
|---|
| User | Galaxyn (UID 98388) |
|---|
| Submission | 07/19/2026 03:55 (2 months ago) |
|---|
| Moderation | 09/04/2026 16:07 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 398799 [ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc Authentication Check g4f/__init__.py ChatCompletion.create missing authentication] |
|---|
| Points | 20 |
|---|