MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2026-7003
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-30T20:08:30.760530+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 5.3
- Retrieved at
- 2026-10-30T20:09:45+00:00
- Score
- 5.3
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-7003
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-10-30T20:05:45+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-10-30T19:19:13.647
- Last modified
- 2026-10-30T19:23:25.493
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph