Live › vulnerability › CVE-2026-111699
Go to dashboardNiefy wx-api through 0.8.2 trusts a raw openid cookie on fan-facing controllers, so no login is checked. An attacker who knows a victim's openid can read that fan's nickname, phone, unionid and tags, and add or remove tags.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the Niefy wx-api project (version 0.8.2 or earlier) as a WeChat fan-management backend, where the openid cookie is accepted for /wxUser/getUserInfo and /wxUserTags. Systems that do not run this project are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
This page as .md · .json · in your agent: get_signal("CVE-2026-111699")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.