Sparx Enterprise Architect EUVD-2025-209499

Q: What is the CVSS score of EUVD-2025-209499?

EUVD-2025-209499 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-15621 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-04-16 NCSC-FI

GHSA-g8rx-2jmm-3847

Information Disclosure Sparx Enterprise Architect Sparx Systems Pty Ltd

5.7

CVSS 4.0 · Vendor: NCSC-FI

Severity by source

Vendor (NCSC-FI) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X

vuln.today AI

6.1 MEDIUM

Local attack vector and low privileges required; high complexity and user interaction needed; scope change reflects credential use across systems; no availability impact.

3.1 AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (NCSC-FI).

CVSS VectorVendor: NCSC-FI

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:41 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 12:45 euvd

EUVD-2025-209499

CVE Published

Apr 16, 2026 - 12:40 nvd

MEDIUM 5.7

DescriptionCVE.org

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

AnalysisAI

OAuth2 credential theft in Sparx Enterprise Architect 16.1.1627 is possible because the client fails to validate the 'aud' (audience) claim of tokens received during OpenID Connect authentication, allowing a local attacker to capture credentials intended for a different relying party. An attacker with low-privileged local access who can position themselves in the OAuth2 exchange - when a victim user is actively authenticating - can obtain high-value OAuth2 credentials and gain access to protected resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS is 0.02% and SSVC exploitation status is 'none'.

Technical ContextAI

OpenID Connect (OIDC), built on OAuth2, requires that the receiving client validate the 'aud' (audience) claim in the ID token to confirm the token was issued specifically for that client application. CWE-522 (Insufficiently Protected Credentials) applies here because Sparx Enterprise Architect, when configured to authenticate users via OpenID/OAuth2, does not perform this receiver verification. The affected product is identified by CPE cpe:2.3:a:sparx_systems_pty_ltd.:sparx_enterprise_architect:*:*:*:*:*:*:*:*, a commercial UML and enterprise modeling tool. The flaw enables a 'confused deputy' or token-injection scenario where a malicious application or intercepting process on the same host can present a token issued to itself and have it accepted as valid by the Enterprise Architect client, or capture a token mid-flow before audience is enforced.

RemediationAI

Upgrade Sparx Enterprise Architect to version 17.1 or later; the vendor's release history at https://sparxsystems.com/products/ea/17.1/history.html is the primary reference, though the exact patch version within the 17.x line is not independently confirmed from the available data - verify with the vendor that the specific build addresses CVE-2025-15621. As a compensating control where immediate upgrade is not feasible, disable OpenID Connect/OAuth2 authentication in Enterprise Architect and revert to alternative authentication methods; note this removes SSO capability. Additionally, restrict Enterprise Architect installation to hardened, single-user endpoints and enforce endpoint detection controls to limit the local access prerequisite the attacker requires. See the VulDB advisory at https://vuldb.com/vuln/357920 for additional guidance.