Live › vulnerability › CVE-2026-7003
WIT SynApps Runtime through 1.4.11 ships a static OAuth clientId and clientSecret inside JavaScript served to the browser, such as parameters.js. An unauthenticated attacker can read those values and reproduce the application's part of the REDY authentication flow at /web/api/v1/auth/token.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Any deployment of WIT SynApps Runtime at or below 1.4.11 that serves the frontend with the embedded OAuth client values is exposed. The sources do not say whether the flaw reaches systems where the frontend is restricted or the auth endpoint is not exposed, so teams should check their own deployment.
No product ranges from the sources yet.
parameters.js for clientSecret or clientId.1.4.11.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
This page as .md · .json · in your agent: get_signal("CVE-2026-7003")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.