CVE-2026-6126
Authentication Bypass in CowAgent 2.0.4 Administrative HTTP Endpoint
Publication date: 2026-04-12
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zhayujie | chatgpt-on-wechat | 2.0.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the zhayujie chatgpt-on-wechat CowAgent version 2.0.4, specifically in an unknown function of the Administrative HTTP Endpoint component. The issue causes missing authentication, meaning that unauthorized users can potentially access administrative functions without proper credentials.
The vulnerability can be exploited remotely, and the exploit code has been made publicly available. Despite early notification to the project maintainers, no response or fix has been provided yet.
How can this vulnerability impact me? :
Because the vulnerability allows remote attackers to bypass authentication on an administrative endpoint, it can lead to unauthorized access to administrative functions. This could result in attackers manipulating or controlling the affected system, potentially leading to data breaches, system compromise, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves missing authentication in an administrative HTTP endpoint, which could allow remote attackers to exploit the system without proper access controls.
Such a weakness could potentially lead to unauthorized access to sensitive data or administrative functions, which may impact compliance with standards and regulations like GDPR and HIPAA that require strict access controls and protection of personal or sensitive information.
However, specific impacts on compliance are not detailed in the provided information.