6 matches found
EUVD-2026-120540
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...
CVE-2026-125377
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...
CVE-2026-125377: pig-mesh pig: Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users…
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...
CVE-2026-125377
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...
CVE-2026-125377 Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...
PT-2026-141200
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...