CVE-2026-6126
zhayujie chatgpt-on-wechat CowAgent Administrative HTTP Endpoint missing authentication
CVSS Score
7.3
EPSS Score
0.1%
EPSS Percentile
22th
A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.0.4. The affected element is an unknown function of the component Administrative HTTP Endpoint. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-306 CWE-287 |
| Vendor | zhayujie |
| Product | chatgpt-on-wechat cowagent |
| Published | Apr 12, 2026 |
| Last Updated | Apr 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for zhayujie chatgpt-on-wechat cowagent
Be the first to know when new high vulnerabilities affecting zhayujie chatgpt-on-wechat cowagent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
zhayujie / chatgpt-on-wechat CowAgent
2.0.4
References
vuldb.com: https://vuldb.com/vuln/356990 vuldb.com: https://vuldb.com/vuln/356990/cti vuldb.com: https://vuldb.com/submit/793554 vuldb.com: https://vuldb.com/submit/795335 github.com: https://github.com/zhayujie/chatgpt-on-wechat/issues/2733 github.com: https://github.com/zhayujie/chatgpt-on-wechat/issues/2733#issue-4177804035
Credits
🔍 Yu_Bao (VulDB User) VulDB CNA Team