WIT SynApps Runtime versions up to 1.4.11 embed static OAuth clientId and clientSecret values directly in the JavaScript delivered to users, specifically in files such as parameters.js. This hardcoded credential flaw allows attackers who can access the public web interface to read the credentials from the client side, thereby enabling them to forge application requests. The exposed client credentials compromise the confidential-client assurance of the OAuth implementation, potentially allowing an attacker to obtain access tokens and interact with protected resources as if they were the legitimate application.

The vulnerability affects the WIT SynApps Runtime product, specifically all releases up to and including version 1.4.11. No other vendors or product versions are listed as impacted by this issue.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw without authentication by simply accessing the application's publicly served JavaScript files, which are then used to duplicate the application portion of the REDY authentication flow at the /web/api/v1/auth/token endpoint. The attack requires network access to the application but no special privileges beyond the ability to view the web content.