What is CVE-2026-14714?

CVE-2026-14714 is a medium-severity vulnerability in Zhayujie Chatgpt-On-Wechat Cowagent, classified under Improper Authentication. CVSS score: 6.5/10. Published 2026-07-05.

How severe is CVE-2026-14714?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Zhayujie Chatgpt-On-Wechat Cowagent

CVE-2026-14714

A weakness has been identified in zhayujie chatgpt-on-wechat CowAgent 2.1.0. This issue affects the function verify_server of the file channel/wechatmp/common.py of the component wx Endpoint. This manipulation of the argument wechatmp_token causes missing authentication. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 3d7c68bac6ee74fad63f43cf99e45c62e202ed55. It is suggested to upgrade the affected component. The project confirms: "We've added an explicit non-empty check for wechatmp_token in verify_server() so that the /wx endpoint now fails closed with 403 Forbidden whenever the token is missing or left at the default empty value, instead of relying on a signature check that silently degenerates to a predictable hash."

Vulnerability class: Broken Authentication

Published 2026-07-05 · last modified 2026-07-06.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

EPSS: 0.008 (54.6th percentile), scored 2026-10-07.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Zhayujie Chatgpt-On-Wechat Cowagent — versions 2.1.0, 2.1.1

Weakness classification (CWE)

References

vuldb.com/vuln/376304 (technical-description, vdb-entry)
vuldb.com/vuln/376304/cti (signature, permissions-required)
vuldb.com/cve/CVE-2026-14714 (third-party-advisory)
vuldb.com/submit/847484 (third-party-advisory)
github.com/zhayujie/CowAgent/issues/2860 (issue-tracking, exploit)
github.com/zhayujie/CowAgent/commit/3d7c68bac6ee74fad63f43cf99e45c62e202ed55 (patch)
github.com/zhayujie/CowAgent/releases/tag/2.1.1 (patch)

Frequently asked questions

What is CVE-2026-14714?: CVE-2026-14714 is a medium-severity vulnerability in Zhayujie Chatgpt-On-Wechat Cowagent, classified under Improper Authentication. CVSS score: 6.5/10. Published 2026-07-05.
How severe is CVE-2026-14714?: Medium severity. CVSS v3 base score is 6.5 out of 10.