CVE-2026-7003 Details
Description
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
A vulnerability exists in WIT SynApps Runtime versions through 1.4.11, where hardcoded OAuth credentials are embedded in JavaScript files delivered to the frontend. This vulnerability allows unauthenticated attackers to extract static clientId and clientSecret values, which can then be used to bypass confidential-client assurance in the OAuth implementation. The extracted credentials can be used to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint.
It is recommended to rotate the exposed application credentials, redesign the frontend to treat it as a public client using an appropriate flow such as Authorization Code with PKCE, or move confidential-client operations to a trusted server-side component. Additionally, tokens should be bound to the intended client, user, target controller, and session context, and application credentials that have been distributed in earlier frontend bundles should be monitored and revoked.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f58336f54517142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIT | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/wit-synapps-runtime-hardcoded-oauth-credentials-disclosure | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WIT SynApps Runtime | <= 1.4.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |