CVE-2026-125377 · Package
NO FIX YET · SEE WHAT TO DO
Pig before 4.1.2 has a missing authorization check in SysClientController, so any authenticated user without client-management permission can read OAuth2 client secrets through GET /client/{clientId} and GET /client/export. An attacker who gets those secrets can request tokens for the affected clients using their configured grant types.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Pig (the Java/Spring-based admin and auth platform) before 4.1.2 where ordinary authenticated users can reach the client endpoints. The sources name the seed clients pig, app and daemon as examples. Deployments that restrict these endpoints to privileged roles at the gateway may be less exposed, but the sources do not say how much that reduces risk.
Not affected if version-4.1.2-or-later
Who cares java, oauth2, pig, self-hosted, spring
SysClientController class and the /client/{clientId} and /client/export routes in the Pig deployment.4.1.2 are affected.4.1.2 or later.Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.