CVE-2026-125377
6.5 MEDIUMpublic exploit availablePublished 2026-11-10 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Public exploit & PoC references
- https://github.com/pig-mesh/pig
- https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82
- https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3
- https://github.com/pig-mesh/pig/issues/1298
- https://github.com/pig-mesh/pig/releases/tag/v4.1.2
All references
- https://github.com/pig-mesh/pig
- https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82
- https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3
- https://github.com/pig-mesh/pig/issues/1298
- https://github.com/pig-mesh/pig/releases/tag/v4.1.2
- https://www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-client
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-11455
- MEDIUMCVE-2025-12523PoC
- MEDIUMCVE-2025-1397
- MEDIUMCVE-2025-14484
- MEDIUMCVE-2025-14486
- MEDIUMCVE-2025-14487
- MEDIUMCVE-2025-62819
- MEDIUMCVE-2025-7043
Related by shared AI tags and CWE weakness class. Browse the full archive.