Medium severity6.5NVD Advisory· Published Nov 10, 2026· Updated Nov 10, 2026
CVE-2026-125377
CVE-2026-125377
Description
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.javanvd
- github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3nvd
- github.com/pig-mesh/pig/issues/1298nvd
- github.com/pig-mesh/pig/releases/tag/v4.1.2nvd
- www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-clientnvd
News mentions
0No linked articles in our index yet.