CVE-2026-14714

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-14714

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14714.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-14714

Published

2026-07-05T05:30:09.514Z

Modified

2026-07-15T01:48:59.858288455Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

zhayujie chatgpt-on-wechat CowAgent wx Endpoint common.py verify_server missing authentication

Details

A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verifyserver of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmptoken causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmptoken in verifyserver() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14714.json",
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/zhayujie/cowagent

Affected ranges

Type

GIT

Repo

https://github.com/zhayujie/cowagent

Events

Introduced

feaa9076b0d5eb60cab5ada6aec20f09d4d774fb

Fixed

3d7c68bac6ee74fad63f43cf99e45c62e202ed55

Fixed

8cb53e612919ddbd8231dd86e6c060222b517536

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.1.0"
        },
        {
            "last_affected": "2.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14714.json"