EUVD-2026-114263: SynApps Runtime hardcoded OAuth credentials exposed to unauthenticated users
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- WIT
- Product
- SynApps Runtime
- First seen
Summary
The EUVD entry, scored 6.9/10 (CVSS v3.1), says SynApps Runtime through 1.4.11 embeds static OAuth clientId and clientSecret values in frontend JavaScript. The item says unauthenticated attackers can recover them.
If you use WIT
Check whether you run SynApps Runtime 1.4.11 or earlier
Rotate the OAuth client credentials once a fixed release is available
Upgrade to a patched version when the vendor publishes one
Restrict external access to the affected endpoints in the meantime
Upgrade SynApps Runtime to a version later than 1.4.11 once a fix is available
Avoid onboarding controllers from untrusted links or sources
What the sources say 3
· Mastodon: “WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability” Source
· Mastodon: “WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js” Source
· Mastodon: “WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding” Source