CVE-2026-7003

The record

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.

Affected packages

Related vulnerabilities

• CVE-2026-61729 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-798
• CVE-2026-119662 Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows… CWE-798
• CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official website… CWE-798
• CVE-2026-118601 Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. CWE-798
• CVE-2026-18449 The BMC does not correctly enforce integrity and encryption requirements for IPMI… CWE-798
• CVE-2026-54631 Part-DB is an open source inventory management system for electronic components. CWE-798
• CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs… CWE-798
• CVE-2026-87950 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows… CWE-798