CVE-2026-125377: Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pigto a version that resolves this vulnerability.Fixed in 4.1.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who lacks client-management permission can exploit the affected endpoints. The issue is remotely reachable and does not require user interaction.
What access does an attacker need to retrieve the secrets?
The attacker needs valid authentication to the application. They can then request GET /client/{clientId} or GET /client/export to obtain clientSecret values without the required authorization.
What information can be exposed and how could it be used?
OAuth2 client secrets for seed clients such as pig, app, and daemon may be exposed, along with client data returned by the export endpoint. An attacker can use obtained secrets to request tokens through the clients' configured grant types.
Which versions are affected?
Pig versions before 4.1.2 are affected.