Is CVE-2026-7003 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7003 being exploited in the wild.

How severe is CVE-2026-7003?

Medium severity, with a CVSS score of 5.3, published 30 October 2026.

Which products and versions are affected?

WIT SynApps Runtime through 1.4.11.

How is CVE-2026-7003 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-7003?

Check whether you run WIT SynApps Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7003: WIT SynApps Runtime hardcoded OAuth credentials

CVE-2026-7003 · Severity: medium · CVSS 5.3 · Published 2026-10-30

WIT SynApps Runtime is a browser-based interface for controlling industrial process automation systems. An attacker can extract static OAuth credentials from the JavaScript frontend delivered to any visitor without authentication, then use those credentials to authenticate to the internal REDY controller and gain access to its API. This undermines the security of the application by exposing credentials that should have remained confidential.

Technologies: WIT SynApps Runtime. Vendors: WIT.

Quick answers

Is CVE-2026-7003 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7003 being exploited in the wild.
How severe is CVE-2026-7003?: Medium severity, with a CVSS score of 5.3, published 30 October 2026.
Which products and versions are affected?: WIT SynApps Runtime through 1.4.11.
Is there a fix for CVE-2026-7003?: No fixed version is recorded yet. Rotate the exposed OAuth credentials immediately. Implement OAuth Authorization Code flow with PKCE instead of embedding confidential secrets in the browser, or move confidential-client operations to a trusted server-side component.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-30"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7003 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-7003?: Check whether you run WIT SynApps Runtime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Rotate the exposed OAuth credentials immediately. Implement OAuth Authorization Code flow with PKCE instead of embedding confidential secrets in the browser, or move confidential-client operations to a trusted server-side component.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-30"}]

Technical details

The SynApps Runtime frontend embeds static OAuth clientId and clientSecret values in JavaScript files (specifically parameters.js) delivered to unauthenticated clients. An attacker can recover these values through inspection of the frontend code and replay them against the /web/api/v1/auth/token endpoint to reproduce the REDY authentication flow. The vulnerability stems from treating browser-delivered secrets as confidential, which violates OAuth security principles for public clients.

Affected products

WIT SynApps Runtime through 1.4.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.