CVE-2026-111699: Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need to authenticate, but must know a victim fan's WeChat openid. They can supply that value as a raw openid cookie when calling affected fan-facing endpoints.
Which data and actions are exposed?
The /wxUser/getUserInfo endpoint can expose a fan's nickname, phone number, and unionid. The /wxUserTags endpoints can disclose tags and allow an attacker to add or remove fan tags.
Are deployments running version 0.8.2 affected?
Yes. The affected range is stated as Niefy wx-api through 0.8.2, which includes version 0.8.2.