CVE-2026-6129 MEDIUM

CVE-2026-6129: zhayujie chatgpt-on-wechat CowAgent Agent Mode Service missing authentication

Vendor Zhayujie
Product chatgpt-on-wechat CowAgent
Weakness CWE-306 · Missing auth
Published April 12, 2026
Last update April 15, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was detected in zhayujie chatgpt-on-wechat CowAgent up to 2.0.4. This affects an unknown function of the component Agent Mode Service. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

April 12, 2026 CVE published
April 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-26055 Unauthenticated Admission Webhook Endpoints in Yoke ATC CVE-2025-5095 Burk Technology ARC Solo Missing Authentication for Critical Function CVE-2025-34190 Vasion Print (formerly PrinterLogic) PrinterInstallerClientService Authentication Bypass via LD_PRELOAD Hooking CVE-2024-12106 WhatsUp Gold - LDAP configuration interface leading to allowing attacker to configure LDAP settings without authentication CVE-2024-48966 Life2000 service tools for test and calibration do not support user authentication