CVE-2025-15622
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability in Sparx Enterprise Architect involves insufficiently protected credentials. The client reveals the plaintext OAuth2 client secret, decoding it and using it to exchange for access and ID tokens as part of the OpenID authentication flow.
Risk Assessment
Attackers could intercept the OAuth2 client secret and gain unauthorized access to protected resources. This may lead to a breach of confidentiality and integrity of organizational data.
Recommendation
Update Sparx Enterprise Architect to the latest version that fixes this vulnerability. Consider implementing additional secret protection mechanisms, such as storing them in a secure vault.
Other vulnerabilities in Sparx Enterprise Architect
See all- CVE-2026-42098High
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior and log in as any other user or administrator, allowing for any changes to the repository.
- CVE-2025-15621Medium
Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication.
Original NVD description (English source)
Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS