WIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WIT SynApps Runtime (the SynApps web application and its frontend) is affected because it ships hardcoded OAuth client credentials in its publicly served JavaScript. An unauthenticated attacker could retrieve these values and use them to mimic the application's login flow, which undermines the security assumption that the OAuth client's secret is kept confidential.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WIT SynApps Runtime
through 1.4.11