---
id: "CVE-2026-7003"
kind: "vulnerability"
aliases: ["CVE-2026-7003"]
title: "WIT SynApps Runtime: hardcoded OAuth client secret exposed in frontend JavaScript"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["oauth", "runtime", "self-hosted", "synapps-runtime"]
not_affected_if: ["unknown"]
published_at: "2026-10-30T19:19:13+00:00"
first_seen_at: "2026-10-30T19:25:30+00:00"
updated_at: "2026-10-30T19:26:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7003", "first_seen_at": "2026-10-30T19:25:30+00:00"}]
---

# WIT SynApps Runtime: hardcoded OAuth client secret exposed in frontend JavaScript

WIT SynApps Runtime through 1.4.11 ships a static OAuth clientId and clientSecret inside JavaScript served to the browser, such as parameters.js. An unauthenticated attacker can read those values and reproduce the application's part of the REDY authentication flow at /web/api/v1/auth/token.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Search the deployed frontend bundles and files like `parameters.js` for `clientSecret` or `clientId`.
- Check the SynApps Runtime version in use; the flaw is in releases through `1.4.11`.

## Timeline

- 2026-10-30T19:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-7003

## From the sources

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_