CVE-2026-7003
WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Apr 24, 2026
Description
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-798 Use of Hard-coded Credentials
Affected Products
| Product | Versions |
|---|---|
SynApps RuntimeWIT |
|
References
- Researcher Disclosuretechnical-descriptionexploit
- VulnCheck Advisory: WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.