Threats tagged 'ghsa-qxh8-8wmv-c8mp'

WIT SynApps Runtime versions through 1.4.11 have a vulnerability involving hardcoded OAuth client credentials exposed in frontend JavaScript files. This exposure allows unauthenticated attackers to obtain static clientId and clientSecret values, enabling them to impersonate the application in the OAuth authentication flow at the /web/api/v1/auth/token endpoint. The vulnerability undermines the confidentiality of the OAuth client credentials but does not impact integrity or availability.