zhayujie chatgpt-on-wechat CowAgent 2.1.0 wx Endpoint common.py verify_server wechatmp_token missing authentication

Summaryinfo

A vulnerability described as critical has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. Impacted is the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. Such manipulation of the argument wechatmp_token leads to missing authentication. This vulnerability is traded as CVE-2026-14714. The attack may be launched remotely. Furthermore, there is an exploit available. Upgrading the affected component is recommended. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."

Detailsinfo

A vulnerability was found in zhayujie chatgpt-on-wechat CowAgent 2.1.0 and classified as critical. Affected by this issue is the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. The manipulation of the argument wechatmp_token with an unknown input leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is integrity, and availability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-14714. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."

Upgrading to version 2.1.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 3d7c68bac6ee74fad63f43cf99e45c62e202ed55 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Chat Software

Vendor

• zhayujie

Name

• chatgpt-on-wechat CowAgent

Version

• 2.1.0

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #847484: zhayujie chatgpt-on-wechat / CowAgent 2.1.0 Missing Authentication for Critical Function (CWE-306) (by Eric-j)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion