{"id":"CVE-2025-15621","aliases":["EUVD-2025-209499","GHSA-g8rx-2jmm-3847"],"status":"published","title":"Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication","description":"Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication","severity":{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/S:P/AU:Y/V:C/RE:M","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00106,"percentile":0.01114,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-522"],"published":"2026-04-16T12:40:08Z","modified":"2026-10-07T09:10:00Z","products":[{"vendor":"sparx systems pty ltd.","product":"sparx enterprise architect"},{"vendor":"sparxsystems","product":"enterprise_architect"}],"references":[{"url":"https://sparxsystems.com/products/ea/17.1/history.html","tags":["Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15621"},{"url":"https://github.com/advisories/GHSA-g8rx-2jmm-3847"}],"sources":{"cve":[{"id":"CVE-2025-15621","title":"Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication","description":"Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication","status":"published","published":"2026-04-16T12:40:08.962Z","modified":"2026-04-16T12:51:51.633Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/S:P/AU:Y/V:C/RE:M","level":"medium","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-209499","description":"Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication","status":"published","published":"2026-04-16T12:40:08Z","modified":"2026-04-16T12:51:51Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/S:P/AU:Y/V:C/RE:M","level":"medium"}],"updated_at":"2026-11-02T19:24:24.796113Z"}],"ghsa":[{"id":"GHSA-g8rx-2jmm-3847","title":"Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client...","description":"Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication","status":"published","published":"2026-04-16T15:31:32Z","modified":"2026-08-21T18:35:52Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X","level":"medium"},{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:10:50.012908Z"}],"nvd":[{"id":"CVE-2025-15621","description":"Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication","status":"published","published":"2026-04-16T13:16:43.423Z","modified":"2026-10-07T09:10:00.16Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:02.090779Z"}]}}