CVE-2026-14714 zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
Attackers can bypass authentication on the wx endpoint due to missing token validation, allowing unauthorized access to the ChatGPT-on-WeChat bot service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14714?
CVE-2026-14714 is a medium-severity missing authorization vulnerability in zhayujie chatgpt-on-wechat CowAgent, published on 5 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmp_token causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."
Which versions are affected by CVE-2026-14714?
How do I fix CVE-2026-14714?
No fix has been published for CVE-2026-14714 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-14714 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14714 exists.
Sources
Also known as GHSA-wh4m-9grw-87fp.