PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15621 Sparx Systems Pty Ltd. CVE debrief

The CVE record for CVE-2025-15621 was published on 2026-04-16T13:16:43.423Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects Sparx Systems Pty Ltd. Sparx Enterprise Architect, specifically in its handling of OAuth2 credentials during OpenID authentication, leading to insufficiently protected credentials. Security teams and administrators should review the configuration and update their systems to mitigate the risk. The vulnerability has a CVSS score of 5.7 and is classified as MEDIUM severity.

Vendor
Sparx Systems Pty Ltd.
Product
Sparx Enterprise Architect
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-16
Original CVE updated
2026-09-30
Advisory published
2026-04-16
Advisory updated
2026-09-30

Who should care

Security teams and administrators responsible for Sparx Enterprise Architect installations should review and update their systems to mitigate the risk of insufficiently protected credentials. This includes reviewing OAuth2 credential handling and OpenID authentication configuration, and implementing additional security measures to protect credentials.

Technical summary

The client in Sparx Systems Pty Ltd. Sparx Enterprise Architect does not verify the receiver of OAuth2 credentials during OpenID authentication, leading to insufficiently protected credentials. This vulnerability has a CVSS score of 5.7 and severity MEDIUM. The affected product versions are from 16.1.1627 to 17.1.1714. Security teams should review and update their systems to mitigate the risk.

Defensive priority

Medium priority due to insufficiently protected credentials

Recommended defensive actions

  • Verify and update Sparx Enterprise Architect to the latest version
  • Review OAuth2 credential handling and OpenID authentication configuration
  • Implement additional security measures to protect credentials
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official sources indicates insufficiently protected credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. The client does not verify the receiver of OAuth2 credentials during OpenID authentication, with a CVSS score of 5.7 and severity MEDIUM. The affected product versions are from 16.1.1627 to 17.1.1714. Defenders should verify the configuration of OAuth2 credential handling and OpenID authentication.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-15621 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-15621

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-15621 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-15621

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://sparxsystems.com/products/ea/17.1/history.html

    db4dfee8-a97e-4877-bfae-eba6d14a2166 - Release Notes

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.