{"id":"CVE-2026-111699","title":"Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie","summary":"Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid c…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-306"],"vendor":"niefy","product":"wx-api","affected":["wx-api <= 0.8.2"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:39:53.049Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111699","references":[{"url":"https://hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-pii"},{"url":"https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserController.java#L31-L37"},{"url":"https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserTagsController.java#L31-L45"},{"url":"https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConfig.java#L43-L49"},{"url":"https://www.vulncheck.com/advisories/niefy-wx-api-through-0.8.2-authentication-bypass-via-unverified-openid-cookie","label":"VulnCheck Advisory: Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.654Z","slug":"CVE-2026-111699","body":"## Overview\n\nNiefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.\n\n## Affected\n\n- `wx-api <= 0.8.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}