CVE-2026-14714
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile — higher than 36% of all known CVEs
Summary
A missing authentication vulnerability exists in the verify_server function of the wx Endpoint component in zhayujie chatgpt-on-wechat CowAgent 2.1.0. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of unauthorized access to the /wx endpoint, potentially leading to bot takeover or data leakage.
Recommendation
Upgrade immediately to version 2.1.1, which includes the patch 3d7c68bac6ee74fad63f43cf99e45c62e202ed55.
Original NVD description (English source)
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmp_token causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."