---
id: CVE-2025-15622
title: Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd
summary: "Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect.\_Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an …"
severity: none
cwe:
  - CWE-522
published: '2026-04-17'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T22:10:00.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15622'
references:
  - url: 'https://sparxsystems.com/products/ea/17.1/history.html'
    label: db4dfee8-a97e-4877-bfae-eba6d14a2166
tags:
  - nvd
epss: 0.00155
epssPercentile: 0.04003
ingestedAt: '2026-09-30T22:27:27.760Z'
---

## Overview

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.