Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

Advisories

Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

Severity: high
Date: 11/9/2026
Affecting: pig >= 0, < 4.1.2
CVE: CVE-2026-125377
CWE: CWE-862 Missing Authorization
CVSS: 7.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References: GitHub Issue #1298
https://github.com/pig-mesh/pig
https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82
https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3
pig v4.1.2 Release Notes
Credit: hieuPenguinnn
Description: Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo