CVE-2026-125377

MediumCVSS 6.5/10Last modified Nov 14, 2026

Description

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2026
Last modified: Nov 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1253784.3PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/a CVE-2026-1253793.1Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted CVE-2026-125385.4IBM MQ 9.4.0.0 to 9.4.0.26, 9.4.1.0 to 9.4.5.3, and 10.0.0.1 to 10.0.0.5 could allow an authenticated attacker to obtain sensitive informati CVE-2026-1253806.5DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to exec CVE-2026-1253815.3DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by CVE-2026-1253827.2Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators hol CVE-2026-1253839.8INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused b CVE-2026-1253849.8INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator CVE-2026-1253856.5INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the d CVE-2026-1253865.3langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows aut CVE-2026-1253875.4Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify t CVE-2026-1253886.5Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users