---
id: CVE-2026-111699
title: Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
summary: >-
  Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability
  that allows unauthenticated attackers to impersonate WeChat fans by supplying
  a raw openid cookie to fan-facing controllers. Attackers knowing a victim's
  openid c…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-306
vendor: niefy
product: wx-api
affected:
  - wx-api <= 0.8.2
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:53.049Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111699'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-pii
  - url: >-
      https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserController.java#L31-L37
  - url: >-
      https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserTagsController.java#L31-L45
  - url: >-
      https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConfig.java#L43-L49
  - url: >-
      https://www.vulncheck.com/advisories/niefy-wx-api-through-0.8.2-authentication-bypass-via-unverified-openid-cookie
    label: >-
      VulnCheck Advisory: Niefy wx-api through 0.8.2 Authentication Bypass via
      Unverified openid Cookie
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.654Z'
---

## Overview

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.

## Affected

- `wx-api <= 0.8.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.