PT-2026-61707 · Vsee · Clinic

Chris Jones + 2 · CVE-2026-13380 · Published 2026-07-20 · Updated 2026-07-20

NVD

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-201

Related Identifiers

CVE-2026-13380

Affected Products

Clinic

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-13380 · Security Note
• https://labs.sra.io/posts/vseeclinic · Note
• https://vsee.com/clinic · Note