https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T05:37:02.115011+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-125377 CVE-2026-125377 — Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client 2026-11-10T05:37:02.115984+00:00

Affected: pig-mesh pig

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.