your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack

CVE-2026-68929 — FastGPT WeChatチャネル乗っ取りPoC FastGPTのWeChat（iLink）共有チャネルに対する、認証不要かつクロステナントでの乗っ取り。公開されたshareId のみを鍵として利用します。 | ---|--- CVE| CVE-2026-68929（CVSS 4.0 9.3 Critical ） Advisory| GHSA-q4pr-3qpg-9q5v 影響を受けるバージョン| FastGPT = 4.14.10, = 4.15.0, の下にキャッシュされたiLink ログインQRコード を返します。 qrcode/status —...

Exploit for CVE-2026-68929

CVE-2026-68929 — FastGPT WeChat Channel Hijack PoC Unauthenti...

CVE-2026-68929

FastGPT , an open-source LLM platform, is vulnerable to unauthenticated WeChat channel hijack and denial of service in versions prior to 4.15.2 . The WeChat (iLink) share-channel endpoints authorize requests using only the publicly exposed shareId , with no authenticated identity or team-ownershi...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...