CVE-2026-14714

Name of the Vulnerable Software and Affected Versions zhayujie chatgpt-on-wechat CowAgent version 2.1.0

Description A remote authentication bypass exists in the wx Endpoint. The issue resides in the verify server() function within the channel/wechatmp/common.py file. Manipulation of the wechatmp token argument allows an attacker to bypass authentication because the system previously relied on a signature check that would degenerate into a predictable hash if the token was missing or empty. This allows unauthorized access via the '/wx' endpoint.

Recommendations Upgrade to version 2.1.1.