Is CVE-2026-14714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14714 being exploited in the wild.

How severe is CVE-2026-14714?

Medium severity, with a CVSS score of 6.5, published 5 July 2026.

Which products and versions are affected?

Zhayujie Chatgpt-On-Wechat 2.1.0.

Is there a fix for CVE-2026-14714?

A patch was published on 2026-06-09: Version 2.1.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-14714 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-14714?

Check whether you run Zhayujie Chatgpt-On-Wechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14714: zhayujie CowAgent authentication bypass in WeChat MP endpoint

CVE-2026-14714 · Severity: medium · CVSS 6.5 · Published 2026-07-05

zhayujie chatgpt-on-wechat CowAgent is an AI agent framework that integrates ChatGPT with the WeChat messaging platform. A security flaw in the WeChat Official Account endpoint allows remote attackers to bypass authentication if the system is not configured with a specific security token. This could allow unauthorized parties to interact with the webhook endpoint, potentially disrupting service or sending unauthorized commands.

Technologies: Zhayujie Chatgpt-On-Wechat. Vendors: Zhayujie.

Quick answers

Is CVE-2026-14714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14714 being exploited in the wild.
How severe is CVE-2026-14714?: Medium severity, with a CVSS score of 6.5, published 5 July 2026.
Which products and versions are affected?: Zhayujie Chatgpt-On-Wechat 2.1.0.
Is there a fix for CVE-2026-14714?: A patch was published on 2026-06-09: Version 2.1.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14714 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-14714?: Check whether you run Zhayujie Chatgpt-On-Wechat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in the `verify_server` function within `channel/wechatmp/common.py` of CowAgent 2.1.0. The root cause is a failure to check if the `wechatmp_token` is empty or unconfigured; when missing, the signature verification process degenerates into a predictable hash based on attacker-controlled parameters (timestamp, nonce, etc.). A remote, unauthenticated attacker can exploit this to successfully pass the server verification check on the `/wx` endpoint. The issue is resolved in version 2.1.1 by implementing an explicit non-empty check that returns a 403 Forbidden error if the token is missing.

Affected products

zhayujie chatgpt-on-wechat CowAgent 2.1.0

Timeline

2026-06-09: patched: Version 2.1.1 released with fix
2026-07-05: disclosed: CVE-2026-14714 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.