CVE-2025-15622CWE-522

CVE-2025-15622

published April 17, 2026

CVSS
6.2
EPSS
0%
Percentile
4.3
In the wild
Unconfirmed
What it is

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

The record
Technical detail
CVSS
6.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.3th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-04-17T13:16Z
References (1)
https://sparxsystems.com/products/ea/17.1/history.html · db4dfee8-a97e-4877-bfae-eba6d14a2166
EPSS history
Timeline
  • 17 APR 08:35Z
    Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret
    cvelistv5