CVE-2025-15621

MediumCVSS 6.0

Published: 16/04/2026(UTC)Updated: 21/08/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication.

Risk Assessment

An attacker may intercept OAuth2 credentials, potentially leading to unauthorized access to the system and user data.

Recommendation

Update Sparx Enterprise Architect to a patched version and implement additional mechanisms to verify the receiver of credentials.

Other vulnerabilities in Sparx Enterprise Architect

CVE-2026-42098High
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior and log in as any other user or administrator, allowing for any changes to the repository.

Original NVD description (English source)

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication