wx-api vulnerabilities

CVEs whose affected-version data names the wx-api package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111699Medium· 4.8

today

Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid c…

▾ Sunlitniefy · wx-apivia CVEORG