Hardcoded Credentials Vulnerability in WIT SynApps Runtime by WIT
CVE-2026-7003

6.9MEDIUM

Key Information:

Vendor

Wit

Status
Synapps Runtime
Vendor
CVE Published:
30 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-7003?

WIT SynApps Runtime prior to version 1.4.11 has a vulnerability where hardcoded OAuth clientId and clientSecret are exposed in JavaScript files delivered to the frontend, particularly in parameters.js. This allows unauthenticated attackers to retrieve these sensitive credentials, enabling them to mimic the application part of the REDY authentication flow at the /web/api/v1/auth/token endpoint. Such exposure critically undermines the security assurances of the OAuth implementation, posing significant risks to application integrity.

Affected Version(s)

SynApps Runtime 0 <= 1.4.11

References

https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f583...
technical-descriptionexploit
https://www.vulncheck.com/advisories/wit-synapps-runtime-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bourbon Offensive Security Services
.