CVE-2026-14714: Missing Authentication in zhayujie chatgpt-on-wechat CowAgent
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmp_token causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."
AI Analysis
Technical Summary
The vulnerability in chatgpt-on-wechat CowAgent 2.1.0 arises from the verify_server function in channel/wechatmp/common.py where the wechatmp_token argument is not properly validated. This results in missing authentication, allowing remote attackers to access the /wx endpoint without proper authorization. The project fixed this by enforcing a non-empty check on the token, ensuring the endpoint fails closed with a 403 Forbidden status when the token is absent or default. The fix is included in version 2.1.1.
Potential Impact
An attacker can remotely bypass authentication on the /wx endpoint by exploiting the missing or empty wechatmp_token, potentially gaining unauthorized access to the service. The CVSS 4.0 score is 6.9 (medium severity), indicating a significant but not critical risk. There is no indication of known exploits in the wild at this time.
Mitigation Recommendations
Upgrade to chatgpt-on-wechat CowAgent version 2.1.1, which includes an explicit check for a non-empty wechatmp_token in verify_server(), causing unauthorized requests to be rejected with a 403 Forbidden response. This official fix effectively mitigates the vulnerability.
CVE-2026-14714: Missing Authentication in zhayujie chatgpt-on-wechat CowAgent
Description
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmp_token causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."
CVSS v4.0
Score 6.9medium
Affected software
cpe:2.3:a:zhayujie:chatgpt-on-wechat_cowagent:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in chatgpt-on-wechat CowAgent 2.1.0 arises from the verify_server function in channel/wechatmp/common.py where the wechatmp_token argument is not properly validated. This results in missing authentication, allowing remote attackers to access the /wx endpoint without proper authorization. The project fixed this by enforcing a non-empty check on the token, ensuring the endpoint fails closed with a 403 Forbidden status when the token is absent or default. The fix is included in version 2.1.1.
Potential Impact
An attacker can remotely bypass authentication on the /wx endpoint by exploiting the missing or empty wechatmp_token, potentially gaining unauthorized access to the service. The CVSS 4.0 score is 6.9 (medium severity), indicating a significant but not critical risk. There is no indication of known exploits in the wild at this time.
Mitigation Recommendations
Upgrade to chatgpt-on-wechat CowAgent version 2.1.1, which includes an explicit check for a non-empty wechatmp_token in verify_server(), causing unauthorized requests to be rejected with a 403 Forbidden response. This official fix effectively mitigates the vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-04T07:43:09.434Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a49f10527e9c7971930c8d9
Added to database: 07/05/2026, 05:52:05 UTC
Last enriched: 07/12/2026, 08:50:24 UTC
Last updated: 08/18/2026, 22:49:25 UTC
Views: 175
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.