Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

Advisories

Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

Severity: medium
Date: 10/16/2026
Affecting: wx-api <= 0.8.2
CVE: CVE-2026-111699
CWE: CWE-306 Missing Authentication for Critical Function
CVSS: 6.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-pii
https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserController.java#L31-L37
https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserTagsController.java#L31-L45
https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConfig.java#L43-L49
Credit: hieuPenguinnn
Description: Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo