CVE-2026-125377

Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

7.1 High

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.33%Unchanged since Nov 10, 2026

What each source reports

CVE List Score used7.1

Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

Record: CVE-2026-125377
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-10

EUVDEUVD-2026-1205407.1

Record: EUVD-2026-120540
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-10

GitHub AdvisoriesGHSA-9mr9-9xmv-5w3c7.1

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that...

Record: GHSA-9mr9-9xmv-5w3c
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-10

NVD7.1

Record: CVE-2026-125377
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-862
Updated: 2026-11-10

OSV7.1

Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

Record: CVE-2026-125377
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-862
Updated: 2026-11-11

Affected products

pig-mesh pig

History

History
Recorded	Changed	Sources
Nov 10, 2026	references	NVD, OSV
Nov 10, 2026	published	EUVD
Nov 10, 2026	aliases, references	GitHub Advisories
Nov 10, 2026	cwes, references, severity, title	CVE List
Nov 10, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-125377 is a high vulnerability (CVSS 7.1) in Pig-mesh Pig, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. No source names a fixed version.