{"id":"CVE-2026-125377","state":"PUBLISHED","title":"Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client","description":"Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.","publishedAt":"2026-11-09T23:27:46.791Z","updatedAt":"2026-11-09T23:27:46.791Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["pig-mesh pig"],"affected":[{"vendor":"pig-mesh","product":"pig","packageURL":"pkg:maven/com.pig4cloud/pig","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.1.2","versionType":"semver"}]}],"references":["https://github.com/pig-mesh/pig/issues/1298","https://github.com/pig-mesh/pig","https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82","https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3","https://github.com/pig-mesh/pig/releases/tag/v4.1.2","https://www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-client"],"weaknesses":["CWE-862"],"ingestedAt":"2026-11-09T23:36:06.628Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/125xxx/CVE-2026-125377.json","commit":"b5e35fd13cceb3fc2d7ace24f43c95cd80e7dc5f","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-125377","state":"PUBLISHED","datePublished":"2026-11-09T23:27:46.791Z","dateUpdated":"2026-11-09T23:27:46.791Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-11-09T22:03:06.495Z"},"containers":{"cna":{"title":"Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client","descriptions":[{"lang":"en","value":"Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types."}],"affected":[{"vendor":"pig-mesh","product":"pig","packageURL":"pkg:maven/com.pig4cloud/pig","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.1.2","versionType":"semver"}]}],"references":[{"url":"https://github.com/pig-mesh/pig/issues/1298","tags":["issue-tracking"],"name":"GitHub Issue #1298"},{"url":"https://github.com/pig-mesh/pig","tags":["product"]},{"url":"https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82","tags":["technical-description"]},{"url":"https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3","tags":["patch"]},{"url":"https://github.com/pig-mesh/pig/releases/tag/v4.1.2","tags":["release-notes"],"name":"pig v4.1.2 Release Notes"},{"url":"https://www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-client","name":"VulnCheck Advisory: Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-11-09T23:27:46.791Z"},"datePublic":"2026-10-22T00:00:00.000Z","credits":[{"lang":"en","value":"hieuPenguinnn","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}}}}}