PT-2026-33423 · Sparx Systems Pty · Sparx Enterprise Architect

Published 2026-04-17 · Updated 2026-04-17 · CVE-2025-15622

NVD

CVSS v4.0

6.2

Medium

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-15622

Affected Products

Sparx Enterprise Architect

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-15622 · Security Note
• https://sparxsystems.com/products/ea/17.1/history.html · Note
• https://twitter.com/CVEnew/status/2045102589306437837 · Twitter Post