CVE-2026-125377
Last modified
CVE-2026-125377 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types..
Description
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-125377?
How severe is CVE-2026-125377?
How do I fix CVE-2026-125377?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-125371Tinyproxy through 1.11.3 contains an access control bypass v…4.8
- CVE-2026-125372REBUILD before 4.5.3 contains an authorization bypass vulner…4.3
- CVE-2026-125373IETF Datatracker before 12.83.0 contains an authorization by…5.4
- CVE-2026-125374Krayin CRM before 2.2.8 contains a broken object level autho…4.3
- CVE-2026-125375MrDoc through 1.1.1 contains a missing authorization vulnera…5.4
- CVE-2026-125376VanBlog through 0.54.0 contains an information disclosure vu…5.3
- CVE-2026-125378PowerDNS-Admin before 2026.11.0 contains a missing authoriza…4.3
- CVE-2026-125379Movim through 0.35.5 contains an authorization bypass vulner…3.1
- CVE-2026-12538IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1…5.4
- CVE-2026-125380DataRoom through 3.0.0 contains an incorrect authorization v…6.5
- CVE-2026-125381DataRoom through 3.0.0 contains an sql injection vulnerabili…5.3
- CVE-2026-125382Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation…7.2
Are you affected by CVE-2026-125377?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST