CVE-2025-15622: Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret

Published Apr 17, 2026

Updated

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

Affected Software

1 affected component

Sparx Systems Enterprise Architect

Event History

Apr 17, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·09:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-15622?

The severity of CVE-2025-15622 is categorized as high due to the exposure of plaintext OAuth2 client secrets.

How do I fix CVE-2025-15622?

To fix CVE-2025-15622, update to the latest version of Sparx Enterprise Architect that addresses this vulnerability.

What type of vulnerability is CVE-2025-15622?

CVE-2025-15622 is classified as an Insufficiently Protected Credentials vulnerability.

What impact does CVE-2025-15622 have on my system?

CVE-2025-15622 can lead to unauthorized access due to exposed plaintext OAuth2 client secrets.

Which software versions are affected by CVE-2025-15622?

CVE-2025-15622 affects Sparx Systems Enterprise Architect across various versions, particularly those that reveal plaintext OAuth2 client secrets.