Medium severity4.8NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026
CVE-2026-111699
CVE-2026-111699
Description
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConfig.javanvd
- github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserController.javanvd
- github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserTagsController.javanvd
- hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-piinvd
- www.vulncheck.com/advisories/niefy-wx-api-through-0.8.2-authentication-bypass-via-unverified-openid-cookienvd
News mentions
0No linked articles in our index yet.