Sparx Enterprise Architect CVE-2025-15621

Q: What is the CVSS score of CVE-2025-15621?

CVE-2025-15621 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209499 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-04-16 NCSC-FI

GHSA-g8rx-2jmm-3847

Information Disclosure Sparx Enterprise Architect

5.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 16, 2026 - 12:45 euvd

EUVD-2025-209499

CVE Published

Apr 16, 2026 - 12:40 nvd

MEDIUM 5.7

DescriptionCVE.org

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

Analysis

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication