---
id: CVE-2026-13380
title: >-
  VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP
  credentials in the HTTP responses of three unauthenticated endpoints
summary: >-
  VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP
  credentials in the HTTP responses of three unauthenticated endpoints. The
  credentials are present in these responses only when SFTP connections have
  been configured with…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-201
  - CWE-312
vendor: vsee
product: clinic
affected:
  - clinic = 7.1.26
  - clinic_api = 1.3.0
published: '2026-07-20'
updated: '2026-08-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13380'
references:
  - url: 'https://labs.sra.io/posts/vseeclinic'
    label: 57dba5dd-1a03-47f6-8b36-e84e47d335d8
  - url: 'https://vsee.com/clinic'
    label: 57dba5dd-1a03-47f6-8b36-e84e47d335d8
tags:
  - nvd
epss: 0.00393
epssPercentile: 0.30677
ingestedAt: '2026-08-15T15:26:57.641Z'
---

## Overview

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

## Affected

- `clinic = 7.1.26`
- `clinic_api = 1.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.