{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"com.pig4cloud/pig","product":"pig","source":"CNA: VulnCheck","vendor":"pig-mesh","versions":[{"lessThan":"4.1.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-125377","cwes":["CWE-862"],"description":"Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.5,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794266866791,"publishedAt":1794266866791,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking"],"url":"https://github.com/pig-mesh/pig/issues/1298"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/pig-mesh/pig"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/pig-mesh/pig/releases/tag/v4.1.2"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-client"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3"}],"revision":"9e23cd08108d5d9c26eefe2bb1fdc9745835df5953ab523aa1acc5aaf684c0d0","sources":[{"modifiedAt":1794266866791,"name":"CNA: VulnCheck","retrievedAt":1794269340944,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125377"}],"ssvc":null,"status":"published","title":"Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client","updatedAt":1794269340944}