PT-2026-32158 · Zhayujie · Chatgpt-On-Wechat Cowagent

Yu_Bao · CVE-2026-6126 · Published 2026-04-12 · Updated 2026-04-12

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zahayujie chatgpt-on-wechat CowAgent version 2.0.4

Description A weakness exists in the Administrative HTTP Endpoint component of zhayujie chatgpt-on-wechat CowAgent version 2.0.4 due to missing authentication in an unknown function. This allows for remote attacks. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-6126

Affected Products

Chatgpt-On-Wechat Cowagent

References · 11

• 🔥 https://github.com/zhayujie/chatgpt-on-wechat/issues/2733#issue-4177804035 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6126.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-6126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6126 · Security Note
• https://github.com/zhayujie/chatgpt-on-wechat/issues/2733 · Note
• https://vuldb.com/submit/795335 · Note
• https://vuldb.com/vuln/356990 · Note
• https://twitter.com/infoflowcloud/status/2043285608638882194 · Twitter Post
• https://vuldb.com/vuln/356990/cti · Note
• https://vuldb.com/submit/793554 · Note
• https://twitter.com/CVEnew/status/2043284707324932366 · Twitter Post