What is GHSA-qxh8-8wmv-c8mp?

GHSA-qxh8-8wmv-c8mp is a security advisory published by GitHub Security Advisories with Medium severity. WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows...

Which CVE IDs does GHSA-qxh8-8wmv-c8mp cover?

GHSA-qxh8-8wmv-c8mp covers the following CVE IDs: CVE-2026-7003. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qxh8-8wmv-c8mp?

GHSA-qxh8-8wmv-c8mp has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-qxh8-8wmv-c8mpMediumCVSS 5.3

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows...

Vendor

GitHub Security Advisories

Published

October 30, 2026

Last Modified

October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-7003 →

📋 Description

WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these exposed application credentials to reproduce the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint, undermining confidential-client assurance for the OAuth implementation.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-7003
https://github.com/kmkz/Exploits/tree/4e8e8b995d10a78f58336f54517142b6791d57d4/2026/CVE-2026-7003-7004-7005-WIT
https://www.vulncheck.com/advisories/wit-synapps-runtime-hardcoded-oauth-credentials-disclosure
https://github.com/advisories/GHSA-qxh8-8wmv-c8mp