PT-2026-33311 · Sparx Systems · Enterprise Architect

Published 2026-04-16 · Updated 2026-04-20 · CVE-2025-15621

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/S:P/AU:Y/V:C/RE:M

Name of the Vulnerable Software and Affected Versions Sparx Enterprise Architect (affected versions not specified)

Description Insufficiently protected credentials exist where the client fails to verify the receiver of OAuth2 credentials during OpenID authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-15621

Affected Products

Enterprise Architect

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-15621 · Security Note
• https://sparxsystems.com/products/ea/17.1/history.html · Note
• https://reddit.com/r/CVEWatch/comments/1sqkwog/top_10_trending_cves_20042026 · Reddit Post
• https://twitter.com/CVEnew/status/2045102685456592974 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1spovbk/top_10_trending_cves_19042026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2045105227641078007 · Twitter Post
• https://twitter.com/vuldb/status/2045125165143757132 · Twitter Post