MEDIUM 6.3 NVD
CVE-2026-111699
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw o
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
References
- https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConf
- https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/contr
- https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/contr
- https://hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-pii
- https://www.vulncheck.com/advisories/niefy-wx-api-through-0.8.2-authentication-bypass-via-
This medium severity vulnerability with a CVSS score of 6.3 was published on 2026-10-16 via NVD.
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.