PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15621 Sparx Systems Pty Ltd. CVE debrief

The CVE record for CVE-2025-15621 was published on 2026-04-16T13:16:43.423Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects Sparx Systems Pty Ltd. Sparx Enterprise Architect, specifically in its handling of OAuth2 credentials during OpenID authentication, leading to insufficiently protected credentials. Security teams and administrators should review the configuration and update their systems to mitigate the risk. The vulnerability has a CVSS score of 5.7 and is classified as MEDIUM severity.

Vendor
Sparx Systems Pty Ltd.
Product
Sparx Enterprise Architect
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-16
Original CVE updated
2026-08-21
Advisory published
2026-04-16
Advisory updated
2026-08-21

Who should care

Security teams and administrators responsible for Sparx Enterprise Architect installations should review and update their systems to mitigate the risk of insufficiently protected credentials. This includes reviewing OAuth2 credential handling and OpenID authentication configuration, and implementing additional security measures to protect credentials.

Technical summary

The client in Sparx Systems Pty Ltd. Sparx Enterprise Architect does not verify the receiver of OAuth2 credentials during OpenID authentication, leading to insufficiently protected credentials. This vulnerability has a CVSS score of 5.7 and severity MEDIUM. The affected product versions are from 16.1.1627 to 17.1.1714. Security teams should review and update their systems to mitigate the risk.

Defensive priority

Medium priority due to insufficiently protected credentials

Recommended defensive actions

  • Verify and update Sparx Enterprise Architect to the latest version
  • Review OAuth2 credential handling and OpenID authentication configuration
  • Implement additional security measures to protect credentials
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official sources indicates insufficiently protected credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. The client does not verify the receiver of OAuth2 credentials during OpenID authentication, with a CVSS score of 5.7 and severity MEDIUM. The affected product versions are from 16.1.1627 to 17.1.1714. Defenders should verify the configuration of OAuth2 credential handling and OpenID authentication.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-16T13:16:43.423Z and has not been modified since then.