Which versions of VSee Clinic are affected by CVE-2026-13380?

VSee Clinic 7.1.26 and API 1.3.0 expose SFTP credentials in HTTP responses accessible to any unauthenticated remote attacker, creating direct risk of unauthorized access to clinical data and patient…. A patch is available.

How to fix or mitigate CVE-2026-13380?

Within 24 hours: identify all VSee Clinic 7.1.26 and API 1.3.0 instances with SFTP integration; assume all SFTP credentials are compromised; rotate SFTP credentials immediately; enable access logging on SFTP servers; isolate affected systems from sensitive networks if operationally possible. Within 7 days: audit SFTP access logs for unauthorized activity over the past 90 days; document any accessed patient data; implement network-level restrictions (firewall rules) limiting access to the three exposed VSee Clinic endpoints; contact VSee support for interim hardening recommendations; notify security, compliance, and legal teams. Within 30 days: complete forensic analysis of SFTP access patterns to identify unauthorized access; file regulatory breach notifications if unauthorized access is confirmed; implement network segmentation isolating VSee Clinic infrastructure; deploy continuous monitoring and alerting for exploitation attempts; plan upgrade to patched VSee Clinic versions once vendor releases fixes.

VSee Clinic CVE-2026-13380

Q: What is the CVSS score of CVE-2026-13380?

CVE-2026-13380 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46091 CRITICAL

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-07-20 SRA

GHSA-j3c3-jqmq-4785

Information Disclosure Clinic

9.0

CVSS 4.0 · Vendor: SRA

Severity by source

Vendor (SRA) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network read (AV:N/PR:N/UI:N) discloses credentials (C:H); scope changes (S:C) because the leaked secret grants access to a separate SFTP system; the SFTP-configured precondition is deployment state, not per-attack complexity, so AC:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (SRA).

CVSS VectorVendor: SRA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 20:45 vuln.today

CVE Published

Jul 20, 2026 - 20:11 cve.org

CRITICAL 9.0

DescriptionCVE.org

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

AnalysisAI

Cleartext SFTP credential disclosure in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 allows any unauthenticated remote attacker to harvest working SFTP logins by simply reading the HTTP responses of three exposed endpoints. The credentials appear whenever SFTP integration has been configured in the application, giving the attacker direct access to the backing SFTP server and whatever clinical or file data it holds. No public exploit or CISA KEV listing exists at time of analysis, but with a 9.0 CVSS and zero authentication required, exploitation is trivial once the endpoints are located.

Technical ContextAI

VSee Clinic is a browser-based telehealth/virtual-care platform paired with a REST API (VSee Clinic API 1.3.0). The flaw is a CWE-201 (Insertion of Sensitive Information Into Sent Data) issue: the application embeds the plaintext username/password used for its outbound SFTP file-transfer integration directly into HTTP response bodies served by three endpoints that require no session or token. SFTP is normally used by such platforms to shuttle documents, recordings, imaging, or batch data between the clinic system and an external partner. The CPE data (cpe:2.3:a:vsee:clinic:*) does not pin a fixed version boundary, but the advisory identifies Clinic 7.1.26 and API 1.3.0 as the affected builds. The root cause is not a memory or injection bug - it is an information-flow/output-encoding failure where secret configuration data is returned to unauthenticated callers instead of being restricted to server-side use.

RemediationAI

No vendor-released patched version is identified in the available data, so no exact fix version can be cited - treat patch status as unconfirmed and contact VSee for a fixed build referencing the SRA disclosure at https://labs.sra.io/posts/vseeclinic and vendor resources at https://vsee.com/clinic. As immediate compensating controls: rotate the exposed SFTP credentials now, because any instance that has been running with SFTP configured must be assumed compromised (trade-off: breaks any automated jobs using the old credentials until they are updated). If SFTP is not essential, disable the SFTP integration in the application to stop the credentials from being emitted at all. Restrict network access to the three unauthenticated endpoints via a WAF or reverse-proxy allowlist and block untrusted access to the SFTP server itself by IP allowlisting so leaked credentials cannot be reused from arbitrary hosts (trade-off: requires knowing legitimate source IPs and may disrupt remote integrations). Review SFTP server logs for unexpected logins as a detective control.