CVE-2026-68929: FastGPT WeChat Auth Bypass Vulnerability

CVE-2026-68929 Overview

FastGPT is an open-source large language model (LLM) platform for building AI applications on a knowledge base. Versions prior to 4.15.2 contain a missing authorization flaw [CWE-306] in the WeChat (iLink) share-channel endpoints. The endpoints authorize requests using only the public shareId, without verifying authenticated identity or team ownership. An unauthenticated attacker who knows a victim team's shareId can take the team's WeChat bot offline or hijack the channel by binding it to an attacker-controlled bot. The shareId is exposed in every shared chat URL, iframe, and embed, so it cannot be treated as secret. The issue is fixed in FastGPT 4.15.2.

Critical Impact
Unauthenticated attackers can hijack a victim team's WeChat bot channel, exposing private app responses, displacing the legitimate binding, and consuming victim resources.

Affected Products

FastGPT versions prior to 4.15.2
FastGPT WeChat (iLink) share-channel logout endpoint
FastGPT WeChat (iLink) QR-code status endpoint

Discovery Timeline

2026-08-28 - CVE-2026-68929 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-68929

Vulnerability Analysis

The vulnerability affects two WeChat share-channel endpoints in FastGPT. The logout endpoint is gated only by an existence check on the shareId, yet it wipes the outLink's stored WeChat token. The QR-code status endpoint performs no authorization at all and writes attacker-supplied bot credentials into the outLink identified by shareId.

An attacker generates a QR code for a victim shareId, scans it with their own WeChat account, and calls the status endpoint. This binds the victim team's app to the attacker's bot. The attacker then receives the app's private responses, displaces the legitimate binding, and consumes the victim team's compute resources.

Because the shareId appears in every shared chat URL, iframe, and embed, it is a public identifier. Treating it as an authorization token effectively means no authorization exists on these endpoints.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. The WeChat outLink endpoints trust the public shareId as sufficient proof of caller legitimacy. They perform no session validation, no team-ownership check, and no ownership check against the outLink record being modified.

Attack Vector

Exploitation requires only network access to the FastGPT instance and knowledge of a target shareId, which is publicly exposed in shared chat URLs. No credentials, user interaction, or elevated privileges are required.

typescript

// Patch excerpt: packages/global/openapi/support/outLink/api.ts
// Introduces authenticated outLinkId-based schemas replacing shareId trust

const WechatOutLinkIdSchema = ObjectIdSchema.meta({
  description: '微信发布渠道 ID'
});

/* ============================================================================
 * API: 生成微信发布渠道登录二维码
 * Route: POST /api/support/outLink/wechat/qrcode/generate
 * Description: 为当前团队有管理权限的微信发布渠道生成 iLink 登录二维码。
 * ============================================================================ */

export const WechatQrcodeGenerateBodySchema = z.object({
  outLinkId: WechatOutLinkIdSchema
});
export type WechatQrcodeGenerateBodyType = z.infer<typeof WechatQrcodeGenerateBodySchema>;

export const WechatQrcodeGenerateResponseSchema = z.object({
  qrcode: z.string().meta({ description: 'iLink 二维码标识' }),
  qrcode_img_content: z.string().meta({ description: '二维码内容' }),
  expireTime: z.number().meta({ example: 480, description: '二维码有效期，单位秒' })
});

Source: FastGPT commit 81d3919

Detection Methods for CVE-2026-68929

Indicators of Compromise

Unexpected changes to WeChat outLink token or bound bot credentials for existing share channels.
QR-code generate or status requests for shareId values originating from unauthenticated sessions or unfamiliar IP ranges.
Sudden WeChat bot offline events shortly after calls to the WeChat logout endpoint.
Divergence between the WeChat bot identity users are interacting with and the legitimate team-owned bot.

Detection Strategies

Review web server and application logs for POST requests to WeChat outLink QR-code generate, status, and logout endpoints lacking valid session context.
Correlate shareId values referenced in outLink API calls against expected team ownership records.
Alert on write operations to outLink WeChat token fields performed without an authenticated administrator session.

Monitoring Recommendations

Monitor FastGPT application logs for anomalous access patterns to /api/support/outLink/wechat/* routes.
Track outbound WeChat API traffic for identity changes on bot bindings tied to production share channels.
Ingest FastGPT and reverse-proxy logs into a centralized analytics platform to enable retroactive hunting once upgrades are complete.

How to Mitigate CVE-2026-68929

Immediate Actions Required

Upgrade FastGPT to version 4.15.2 or later without delay.
Audit all existing WeChat outLink bindings and re-bind any channel whose bot credentials cannot be verified as legitimate.
Rotate any WeChat bot tokens that may have been overwritten while the vulnerable version was deployed.
Review access logs for prior calls to the vulnerable QR-code status and logout endpoints.

Patch Information

The fix is delivered in FastGPT 4.15.2 via commit 81d3919. The patch replaces public shareId trust with authenticated outLinkId-based schemas and adds team-ownership checks to the WeChat QR-code generate, status, and logout endpoints. See the GitHub Security Advisory GHSA-q4pr-3qpg-9q5v and the FastGPT commit 81d3919 for implementation details.

Workarounds

Restrict network access to FastGPT WeChat outLink endpoints to trusted administrative networks until the upgrade is applied.
Temporarily disable the WeChat (iLink) share-channel integration if immediate upgrade is not possible.
Place FastGPT behind a reverse proxy that enforces authentication on /api/support/outLink/wechat/* routes.

bash

# Example nginx snippet to restrict WeChat outLink endpoints by source IP
location ~* ^/api/support/outLink/wechat/ {
    allow 10.0.0.0/8;      # trusted admin network
    deny  all;
    proxy_pass http://fastgpt_upstream;
}