Cleartext SFTP credential exposure in VSee Clinic and VSee Clinic API (CVE-2026-13380)

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints when SFTP connections have been configured in the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses can obtain the credentials and use them to access the associated SFTP server. Affected versions: - VSee Clinic 7.1.26 - VSee Clinic API 1.3.0 We recommend updating to: VSee Clinic 7.1.26.1, VSee Clinic API 1.3.0.1. CVSS 9.0 · our assessment: act_now Reference: https://labs.sra.io/posts/vseeclinic Details: https://vuln.today/cve/CVE-2026-13380