{"id":"CVE-2026-7003","kind":"vulnerability","aliases":["CVE-2026-7003"],"related":[],"title":"WIT SynApps Runtime: hardcoded OAuth client secret exposed in frontend JavaScript","description":"WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.","summary":"WIT SynApps Runtime through 1.4.11 ships a static OAuth clientId and clientSecret inside JavaScript served to the browser, such as parameters.js. An unauthenticated attacker can read those values and reproduce the application's part of the REDY authentication flow at /web/api/v1/auth/token.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oauth","runtime","self-hosted","synapps-runtime"],"not_affected_if":["unknown"],"how_to_check":"- Search the deployed frontend bundles and files like `parameters.js` for `clientSecret` or `clientId`.\n- Check the SynApps Runtime version in use; the flaw is in releases through `1.4.11`.","fix":null,"status":"open","published_at":"2026-10-30T19:19:13+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:11+00:00","updated_at":"2026-10-30T19:26:11+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T19:26:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WIT SynApps Runtime: hardcoded OAuth client secret exposed in frontend JavaScript","impact":"medium","summary":"WIT SynApps Runtime through 1.4.11 ships a static OAuth clientId and clientSecret inside JavaScript served to the browser, such as parameters.js. An unauthenticated attacker can read those values and reproduce the application's part of the REDY authentication flow at /web/api/v1/auth/token.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["synapps-runtime","oauth","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reproduces app OAuth flow using exposed client credentials","analyst_note":"Confirm the fixed version and whether a patch exists; the NVD entry is the only source and it states no fix.","how_to_check":"- Search the deployed frontend bundles and files like `parameters.js` for `clientSecret` or `clientId`.\n- Check the SynApps Runtime version in use; the flaw is in releases through `1.4.11`.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Any deployment of WIT SynApps Runtime at or below 1.4.11 that serves the frontend with the embedded OAuth client values is exposed. The sources do not say whether the flaw reaches systems where the frontend is restricted or the auth endpoint is not exposed, so teams should check their own deployment.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4199,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-7003':14A,17A '/web/api/v1/auth/token':66B,119C '1.4.11':30B,71C 'allow':78C 'applic':57B,105C,110C 'assur':125C 'attack':49B,80C,100C 'authent':63B,115C 'browser':43B 'client':6A,124C 'clientid':35B,85C 'clientsecret':37B,87C 'confidenti':123C 'confidential-cli':122C 'contain':72C 'credenti':75C,106C 'cve':12A,15A 'deliv':92C 'embed':89C 'endpoint':120C 'expos':8A,104C 'extract':102C 'flow':64B,116C 'frontend':10A,95C 'hardcod':4A,74C 'host':22B 'implement':129C 'insid':38B 'javascript':11A,39B,91C 'oauth':5A,18B,34B,84C,128C 'parameters.js':46B,99C 'part':59B 'portion':111C 'read':51B 'recov':82C 'redi':62B,114C 'reproduc':55B,108C 'runtim':3A,19B,25B,28B,69C 'secret':7A 'self':21B 'self-host':20B 'serv':40B 'ship':31B 'static':33B,83C 'synapp':2A,24B,27B,68C 'synapps-runtim':23B 'unauthent':48B,79C 'undermin':121C 'valu':53B,88C 'vulner':76C 'wit':1A,26B,67C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of WIT SynApps Runtime at or below 1.4.11 that serves the frontend with the embedded OAuth client values is exposed. The sources do not say whether the flaw reaches systems where the frontend is restricted or the auth endpoint is not exposed, so teams should check their own deployment.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:19:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-7003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7003","severity":null,"published_at":"2026-10-30T19:19:13+00:00","modified_at":"2026-10-30T19:23:25+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}