Sparx Enterprise Architect
Monthly
Sparx Enterprise Architect client stores and transmits OAuth2 client secrets in plaintext, allowing local attackers to extract credentials and impersonate the application to obtain unauthorized access tokens. The vulnerability affects at least version 16.1.1627 and potentially earlier versions; local file system access is required to retrieve the exposed secrets, but once obtained, an attacker can perform remote authentication without additional privileges. NCSC-FI reported this vulnerability and it is tracked as EUVD-2025-209512; exploitation likelihood is elevated due to the ease of credential extraction from local storage.
OAuth2 credential theft in Sparx Enterprise Architect 16.1.1627 is possible because the client fails to validate the 'aud' (audience) claim of tokens received during OpenID Connect authentication, allowing a local attacker to capture credentials intended for a different relying party. An attacker with low-privileged local access who can position themselves in the OAuth2 exchange - when a victim user is actively authenticating - can obtain high-value OAuth2 credentials and gain access to protected resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS is 0.02% and SSVC exploitation status is 'none'.
Sparx Enterprise Architect client stores and transmits OAuth2 client secrets in plaintext, allowing local attackers to extract credentials and impersonate the application to obtain unauthorized access tokens. The vulnerability affects at least version 16.1.1627 and potentially earlier versions; local file system access is required to retrieve the exposed secrets, but once obtained, an attacker can perform remote authentication without additional privileges. NCSC-FI reported this vulnerability and it is tracked as EUVD-2025-209512; exploitation likelihood is elevated due to the ease of credential extraction from local storage.
OAuth2 credential theft in Sparx Enterprise Architect 16.1.1627 is possible because the client fails to validate the 'aud' (audience) claim of tokens received during OpenID Connect authentication, allowing a local attacker to capture credentials intended for a different relying party. An attacker with low-privileged local access who can position themselves in the OAuth2 exchange - when a victim user is actively authenticating - can obtain high-value OAuth2 credentials and gain access to protected resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS is 0.02% and SSVC exploitation status is 'none'.