WIT SynApps Runtime CVE-2026-7003

No special runtime configuration is required: the clientId and clientSecret are hardcoded into JavaScript (such as parameters.js) that WIT SynApps Runtime through 1.4.11 delivers to every frontend client, so any unauthenticated party with network access to the web interface can retrieve and parse those assets to recover the credentials. The limiting factor is scope of impact rather than access: recovering these confidential-client credentials only lets an attacker reproduce the application portion of the REDY OAuth flow at /web/api/v1/auth/token and undermines confidential-client assurance - the input does not establish that it yields user credentials or a complete authentication bypass, and impact is confidentiality-only (VC:L).

This is a genuine but limited-severity confidentiality issue rather than a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity weakness, which is consistent with the description: the OAuth clientId and clientSecret are shipped in frontend JavaScript (e.g. parameters.js) and can be read by anyone who loads the application. However, the impact metrics are deliberately narrow - VC:L with VI:N and VA:N - so the real-world effect is loss of confidentiality of a client credential, not integrity or availability compromise and not, on its own, a full account/authentication bypass. EPSS is not provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no confirmation of active exploitation; the only exploit signal is a GitHub reference that is not verified as working exploit code. The vendor/VulnCheck decision label is 'this_month', which aligns with a moderate, schedule-driven priority rather than an emergency. Note the tag 'Authentication Bypass' overstates the mechanism: the flaw exposes confidential-client credentials and undermines confidential-client assurance of the REDY OAuth flow, but the input does not establish that it alone bypasses user authentication - treat the 'bypass' framing with caution.

An unauthenticated attacker browses to a WIT SynApps Runtime (through 1.4.11) web frontend, downloads the delivered JavaScript such as parameters.js, and extracts the hardcoded OAuth clientId and clientSecret. With those static credentials the attacker can reproduce the application (confidential-client) portion of the REDY authentication flow against the /web/api/v1/auth/token endpoint. A public PoC reference exists but it is not verified as working exploit code.