Authentication Bypass Vulnerability in Niefy wx-api Product

CVE-2026-111699

What is CVE-2026-111699?

The Niefy wx-api, up to version 0.8.2, is vulnerable to an authentication bypass, where unauthenticated attackers can exploit the system by providing a raw openid cookie to access fan-facing controllers. This vulnerability enables malicious actors, armed with a victim's openid, to invoke the /wxUser/getUserInfo and /wxUserTags endpoints, exposing sensitive information including nicknames, phone numbers, unionids, and user tags. Additionally, attackers can manipulate fan tags by adding or removing them without proper authorization, posing a significant risk to user data privacy.

References