CVE-2026-13380
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present only when SFTP connections have been configured. No authentication is required. An unauthenticated remote attacker who observes these HTTP responses can obtain the credentials and access the associated SFTP server.
Risk Assessment
The organization risks an unauthenticated attacker intercepting SFTP credentials and gaining unauthorized access to the SFTP server, potentially leading to data leakage or modification of data stored on that server.
Recommendation
Immediately change the SFTP credentials and configure the VSee Clinic application to not expose them in HTTP responses. Apply updates provided by the vendor.
Original NVD description (English source)
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.