CVE-2025-15622 Sparx Systems Pty Ltd. CVE debrief

Who should care

Defenders responsible for deploying and configuring Sparx Enterprise Architect, especially those using OpenID authentication, should assess exposure and verify OAuth2 client secret handling.

Why it matters

CVE-2025-15622 is a medium-severity vulnerability in Sparx Enterprise Architect that exposes OAuth2 client secrets, potentially leading to credential compromise. Defenders should verify OAuth2 client secret handling, review OpenID authentication configurations, and prioritize remediation efforts.

• Verification of OAuth2 client secret protection is required to prevent potential credential exposure
• Defenders must review OpenID authentication configurations to ensure secure token exchange
• Remediation priority is medium due to the CVSS score of 6.2

Technical summary

The Sparx Enterprise Architect client reveals plaintext OAuth2 client secret, which is then used to exchange for access and id tokens as part of the OpenID authentication flow. This Insufficiently Protected Credentials vulnerability allows for potential credential compromise. The affected product, Sparx Enterprise Architect, requires verification of OAuth2 client secret handling and review of OpenID authentication configurations to mitigate this medium-severity vulnerability with a CVSS score of 6.2. Defenders should prioritize verifying OAuth2 client secret handling in Sparx Enterprise Architect deployments, especially where OpenID authentication is used.

Defensive priority

Defenders should prioritize verifying OAuth2 client secret handling in Sparx Enterprise Architect deployments, especially where OpenID authentication is used.

Recommended defensive actions

• Verify OAuth2 client secret handling in Sparx Enterprise Architect deployments
• Review OpenID authentication flow configurations
• Check for updates or patches from Sparx Systems Pty Ltd.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Insufficiently Protected Credentials vulnerability in Sparx Enterprise Architect. However, the scope of affected versions and specific remediation steps require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.