CVE-2026-7003
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability. Static OAuth clientId and clientSecret values are embedded in JavaScript delivered to the frontend, such as in parameters.js, allowing unauthenticated attackers to recover them.
Risk Assessment
Attackers can use the exposed credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
Recommendation
Remove static OAuth credentials from frontend JavaScript and move them server-side. Rotate the exposed clientId/clientSecret and upgrade to a version without embedded secrets.
Other vulnerabilities in WIT SynApps Runtime
See all- CVE-2026-7005Medium
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts. Attackers can leverage the victim's browser reachability to probe loopback addresses, local hostnames, or internal-only network hosts and initiate enrollment against REDY instances, crossing IT/OT segmentation boundaries.
- CVE-2026-7004Medium
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers can exploit this flaw to harvest credentials, manipulate the login flow, access browser-visible data, and perform same-origin requests to controller endpoints.
Original NVD description (English source)
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS