CVE-2026-7003

Name of the Vulnerable Software and Affected Versions WIT SynApps Runtime versions prior to 1.4.12

Description Hardcoded credentials allow unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in the parameters.js file. Attackers can use these exposed credentials to reproduce the application portion of the REDY authentication flow at the '/web/api/v1/auth/token' endpoint, which undermines the confidential-client assurance of the OAuth implementation.

Recommendations Update WIT SynApps Runtime to version 1.4.12 or later.