Sparx Systems Enterprise Architect: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 6.2
  CVE-2025-15622

  Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret

  Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens a…

  Sparx Systems Sparx Enterprise Architect
  Apr 17, 2026
• Medium 5.7
  CVE-2025-15621

  Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication

  Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

  Sparx Systems Sparx Enterprise Architect
  Apr 16, 2026

Revision history

1. 2026-04-16 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2026-04-16
  https://github.com/advisories/GHSA-G8RX-2JMM-3847
• EU Vulnerability Database vom 2026-04-16
  https://euvd.enisa.europa.eu/enisa/EUVD-2025-209499
• GitHub Advisory Database vom 2026-04-16
  https://github.com/advisories/GHSA-g7j3-235h-9jvv