CVE-2025-15621
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication.
Risk Assessment
An attacker may intercept OAuth2 credentials, potentially leading to unauthorized access to the system and user data.
Recommendation
Update Sparx Enterprise Architect to a patched version and implement additional mechanisms to verify the receiver of credentials.
Other vulnerabilities in Sparx Enterprise Architect
See all- CVE-2026-42098High
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior and log in as any other user or administrator, allowing for any changes to the repository.
- CVE-2025-15622Medium
A vulnerability in Sparx Enterprise Architect involves insufficiently protected credentials. The client reveals the plaintext OAuth2 client secret, decoding it and using it to exchange for access and ID tokens as part of the OpenID authentication flow.
Original NVD description (English source)
Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication
Vulnerability data from NVD (NIST) · CISA KEV · EPSS