Back to Database
Status published
Medium
CVE-2025-15621
Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication
Vulnerability Description
Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15621
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Pasi Orovuo, Solita Oy
- Henri Hämäläinen, Solita Oy
- Samu Ahvenainen, Solita Oy
More from Sparx Systems Pty Ltd.
View All →CVE-2025-15625
Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server
Critical
9.5
CVE-2025-15624
Plaintext Storage of a Password in Sparx Pro Cloud Server.
Critical
9.3
CVE-2025-15623
Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user
Critical
9.3
CVE-2025-15622
Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret
Medium
6.2
Affected Vendor
Sparx Systems Pty Ltd.
View all reports →Affected Software
Sparx Enterprise Architect
Vulnerable Versions:
16.1.1627, 17.1.1714
Timeline
Official Publish:
April 16th, 2026
Last Modified:
April 16th, 2026
Added to House:
July 22nd, 2026