CVE-2025-15622

MEDIUM EPSS 5.0%

Published Apr 17, 20262mo ago · Modified Jun 17, 20262w ago

6.2 CVSS 4.0

Medium

Published Apr 17, 2026 2mo ago

Last Modified Jun 17, 2026 2w ago

Description

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

CVSS Details

Base Score

6.2

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red

Attack Vector Local

Attack Complexity Low

Privileges Required None

User Interaction None

Scope P

Threat Intelligence

EPSS Exploit Probability

5.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-522

References 1

sparxsystems.com https://sparxsystems.com/products/ea/17.1/history.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.