CVE-2026-14714: chatgpt-on-wechat Auth Bypass Vulnerability

CVE-2026-14714 Overview

CVE-2026-14714 is a missing authentication vulnerability in zhayujie chatgpt-on-wechat CowAgent 2.1.0. The flaw resides in the verify_server function of channel/wechatmp/common.py, which handles requests to the /wx WeChat Media Platform (MP) webhook endpoint. When the wechatmp_token configuration value is empty, the signature check degenerates to a predictable hash over attacker-controlled parameters. Remote attackers can manipulate the wechatmp_token argument path to bypass authentication without user interaction. A public exploit is available, and the issue is tracked under [CWE-287]. Upgrading to version 2.1.1 (commit 3d7c68bac6ee74fad63f43cf99e45c62e202ed55) resolves the weakness.

Critical Impact
Unauthenticated remote attackers can reach the WeChat MP webhook endpoint and bypass signature verification when wechatmp_token is left at its default empty value.

Affected Products

zhayujie chatgpt-on-wechat CowAgent 2.1.0
Component: wx Endpoint (channel/wechatmp/common.py)
Function: verify_server

Discovery Timeline

2026-07-05 - CVE-2026-14714 published to NVD
2026-07-06 - Last updated in NVD database
Version 2.1.1 - zhayujie releases patched build with commit 3d7c68bac6ee74fad63f43cf99e45c62e202ed55

Technical Details for CVE-2026-14714

Vulnerability Analysis

The verify_server function in channel/wechatmp/common.py implements the WeChat MP handshake. It reads the wechatmp_token from configuration and passes it to check_signature(token, signature, timestamp, nonce). When administrators leave wechatmp_token empty, the function does not fail closed. Instead, check_signature computes a signature over an empty token combined with attacker-supplied timestamp and nonce values. An attacker who reaches the /wx endpoint can predict the resulting hash and satisfy the check without possessing any shared secret. This weakness maps to [CWE-287] Improper Authentication and enables tampering with limited integrity and availability impact on the webhook handler.

Root Cause

The root cause is a missing non-empty validation on the wechatmp_token configuration value. The verification path trusts that a token was provisioned before invoking the WeChat SDK signature routine. Because the routine hashes user-controlled inputs concatenated with an empty secret, its output becomes deterministic and reproducible by any remote caller.

Attack Vector

The attack is remote and network-based. An attacker sends a crafted GET request to the exposed /wx endpoint supplying signature, timestamp, nonce, and echostr parameters. When the deployed instance has no wechatmp_token configured, the attacker calculates the SHA-1 hash of a sorted list containing only timestamp and nonce, submits it as signature, and receives the echostr echoed back. This confirms webhook control and allows abuse of downstream message routing.

python

         nonce = data.nonce
         echostr = data.get("echostr", None)
         token = conf().get("wechatmp_token")  # 请按照公众平台官网\基本配置中信息填写
+        # Reject when token is empty: an empty token reduces signature verification
+        # to a predictable hash over attacker-controlled values.
+        if not token:
+            raise web.Forbidden("wechatmp_token is not configured")
         check_signature(token, signature, timestamp, nonce)
         return echostr
     except InvalidSignatureException:
         raise web.Forbidden("Invalid signature")
+    except web.Forbidden:
+        raise
     except Exception as e:
         raise web.Forbidden(str(e))

Source: GitHub Commit 3d7c68b

Detection Methods for CVE-2026-14714

Indicators of Compromise

Unexpected HTTP GET requests to /wx from unfamiliar source addresses containing signature, timestamp, nonce, and echostr parameters.
Successful 200 OK responses from /wx echoing back echostr values when no legitimate WeChat MP integration is in use.
Deployment configurations where wechatmp_token is empty or absent in config.json.

Detection Strategies

Grep application configuration for wechatmp_token and alert if the value is empty on any running CowAgent 2.1.0 instance.
Inspect reverse-proxy or web-server logs for repeated requests to /wx originating outside expected WeChat IP ranges.
Correlate webhook handshake traffic with subsequent inbound WeChat MP message events to identify forged handshakes.

Monitoring Recommendations

Log every request to the channel/wechatmp/common.py handler with source IP, parameters, and response code.
Alert on 403 Forbidden responses after upgrading, as these indicate probing against the newly hardened endpoint.
Track outbound calls initiated by the WeChat channel to detect misuse following a successful handshake.

How to Mitigate CVE-2026-14714

Immediate Actions Required

Upgrade zhayujie/CowAgent to version 2.1.1 or later, which includes commit 3d7c68bac6ee74fad63f43cf99e45c62e202ed55.
Set a strong, non-empty value for wechatmp_token in config.json before restarting the service.
Restrict network exposure of the /wx endpoint to WeChat MP source ranges via firewall or reverse-proxy allowlisting.

Patch Information

The upstream fix adds an explicit non-empty check for wechatmp_token inside verify_server(). When the token is missing or empty, the endpoint now fails closed with 403 Forbidden instead of invoking check_signature with an empty secret. Details are available in the GitHub Release 2.1.1 and the GitHub Issue Discussion.

Workarounds

If upgrading immediately is not possible, configure wechatmp_token with a high-entropy value and confirm the WeChat MP admin panel enforces the same token.
Front the CowAgent instance with a reverse proxy that blocks requests to /wx unless they originate from trusted WeChat MP IP ranges.
Disable the wechatmp channel entirely in config.json if it is not required for the deployment.

bash

# Configuration example: set a non-empty wechatmp_token before starting CowAgent
jq '.wechatmp_token = "REPLACE_WITH_STRONG_RANDOM_VALUE"' config.json > config.json.new \
  && mv config.json.new config.json

# Upgrade to the patched release
git fetch --tags
git checkout 2.1.1
pip install -r requirements.txt