Skip to content
CVE PROGRAM SOURCE RECORD6.2 Medium

CVE-2025-15622

Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC-FI

Description

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sparx Systems Pty Ltd. Sparx Enterprise Architect

Default version status: unknown

  • 16.1.1627affected
  • 17.1.1714unaffected

References