Niefy wx-api EUVD-2026-102990

Exploitation requires that the attacker already knows a valid target openid (a WeChat follower identifier) and that a wx-api instance (≤0.8.2) is network-reachable; the attacker then supplies that value as a raw openid cookie to the fan-facing endpoints /wxUser/getUserInfo and /wxUserTags, which the Shiro configuration (ShiroConfig lines 43-49) excludes from authentication. The key LIMITING factor is the openid prerequisite - reflected as AC:H/AT:P - since openids are opaque and non-sequential, so blind mass exploitation is impractical without a prior source of valid openids; impact is further bounded to per-fan PII read and tag add/remove, with no code execution or availability effect.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N, base 6.3) is internally consistent with the description: the flaw is network-reachable and requires no privileges (PR:N), but carries a specific attack requirement (AT:P) and high complexity (AC:H) because the attacker must already know a valid victim openid - an opaque WeChat identifier that is not trivially enumerable. Impact is correctly scoped as Low/Low confidentiality and integrity (PII disclosure plus fan-tag manipulation), with no availability impact. No EPSS score, CISA KEV listing, or published exploit-code POC was provided, so exploitation is not confirmed in the wild. The VulnCheck advisory and the linked HackMD write-up/source references corroborate the root cause (Shiro config excludes fan-facing controllers from authentication), which raises confidence in the technical validity. Overall: a real authentication-bypass/IDOR weakness, but the openid-knowledge prerequisite (AC:H/AT:P) and the niche, self-hosted nature of the product keep realistic risk at the medium level the score suggests rather than a widespread-exploitation threat.

An attacker who has obtained a target WeChat follower's openid (e.g., leaked from another system or a cross-tenant IDOR) sets it as a raw openid cookie and calls the fan-facing endpoints on an exposed wx-api instance. Because the Shiro configuration does not authenticate these controllers, the server trusts the cookie and returns the victim's nickname, phone, and unionid, and lets the attacker add or remove that fan's tags. No public exploit code was identified at time of analysis, though a technical write-up describing the flaw exists.