EUVD-2026-120540

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-125377

Pig versions prior to 4.1.2 are susceptible to a missing authorization vulnerability within the SysClientController component. This flaw allows authenticated users lacking specific client-management permissions to retrieve OAuth2 client secrets via the GET /client/{clientId} and GET /client/expor...

PT-2026-141200

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...