PT-2026-33423 · Sparx Systems · Sparx Enterprise Architect

Published 2026-04-17 · Updated 2026-04-17 · CVE-2025-15622

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions Sparx Enterprise Architect (affected versions not specified)

Description An issue exists where the desktop client reveals the OAuth2 client secret in plaintext. The client decodes this secret and uses it to exchange for access and id tokens during the OpenID authentication flow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-15622

Affected Products

Sparx Enterprise Architect

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-15622 · Security Note
• https://twitter.com/CVEnew/status/2045102589306437837 · Twitter Post
• https://sparxsystems.com/products/ea/17.1/history.html · Note