PT-2026-32158 · Zhayujie · Chatgpt-On-Wechat Cowagent

Yu_Bao · Published 2026-04-12 · Updated 2026-04-12 · CVE-2026-6126

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zahayujie chatgpt-on-wechat CowAgent version 2.0.4

Description A weakness exists in the Administrative HTTP Endpoint component of zhayujie chatgpt-on-wechat CowAgent version 2.0.4 due to missing authentication in an unknown function. This allows for remote attacks. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-6126

Affected Products

Chatgpt-On-Wechat Cowagent

References · 9

• 🔥 https://github.com/zhayujie/chatgpt-on-wechat/issues/2733#issue-4177804035 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6126 · Security Note
• https://github.com/zhayujie/chatgpt-on-wechat/issues/2733 · Note
• https://vuldb.com/vuln/356990/cti · Note
• https://twitter.com/CVEnew/status/2043284707324932366 · Twitter Post
• https://vuldb.com/submit/793554 · Note
• https://vuldb.com/submit/795335 · Note
• https://vuldb.com/vuln/356990 · Note
• https://twitter.com/infoflowcloud/status/2043285608638882194 · Twitter Post