A weakness has been identified in the administrative HTTP endpoint of zhayujie chatgpt‑on‑wechat CowAgent 2.0.4. The endpoint is exposed without requiring any authentication, allowing an attacker who can reach the endpoint over the network to invoke administrator functions. Because the specific function that is vulnerable is not disclosed, the exact consequences are unclear, but the lack of authentication alone permits unauthorized control over the application.

The vulnerability affects the CowAgent component of zhayujie chatgpt‑on‑wechat, specifically the 2.0.4 release. No other product versions are currently known to be impacted by this flaw, and the issue is tied to an unknown administrative HTTP function within that version.

The CVSS base score of 6.9 indicates moderate severity. The exploit relies on remote access to the unprotected administrative endpoint, and a public exploit has been made available, implying that attackers can readily abuse the weakness if the endpoint is exposed. The EPSS score is not provided, and the flaw is not yet listed in the CISA KEV catalog, but the combination of high accessibility, lack of authentication, and confirmed exploitation code suggests that the risk to systems where the endpoint is reachable is significant. Until a vendor patch is released, administrators should treat the exposed endpoint as a high‑credit risk and take mitigation measures immediately.