CVE-2026-14714: zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verifyserver of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmptoken causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmptoken in verifyserver() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zhayujie chatgpt-on-wechat CowAgent wx Endpoint (channel/wechatmp/common.py) verify_serverto a version that resolves this vulnerability.Fixed in 2.1.1Patch 3d7c68bac6ee74fad63f43cf99e45c62e202ed55 - Configuration
Ensure verify_server() performs an explicit non-empty check for wechatmp_token so the /wx endpoint fails closed with 403 Forbidden whenever the token is missing or left at the default empty value.
wx Endpoint (channel/wechatmp/common.py) - verify_server() wechatmp_token check for /wx endpoint = non-empty required (fail closed with 403 Forbidden when missing or default empty)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14714?
The severity of CVE-2026-14714 is medium with a score of 6.5.
How do I fix CVE-2026-14714?
To fix CVE-2026-14714, implement proper authentication in the verify_server function within the wx Endpoint.
What component is affected by CVE-2026-14714?
CVE-2026-14714 affects the wx Endpoint component of zhayujie chatgpt-on-wechat CowAgent version 2.1.0.
What is the vulnerability description for CVE-2026-14714?
CVE-2026-14714 is a weakness that causes missing authentication due to manipulation of the wechatmp_token argument.
Can CVE-2026-14714 lead to security risks?
Yes, CVE-2026-14714 can lead to security risks as it allows an attacker to bypass authentication.