CVE-2025-15621: OAuth Credential Leak in Sparx Enterprise Architect

The core of this vulnerability lies in the lack of validation of the recipient of OAuth2 credentials during the OpenID authentication process. An attacker could potentially intercept or spoof these credentials, impersonating a legitimate user and gaining access to sensitive data within Sparx Enterprise Architect. This could include project models, diagrams, and associated documentation. Successful exploitation could lead to data breaches, unauthorized modifications to critical project assets, and even complete account takeover. The blast radius extends to any data stored and managed within Enterprise Architect, potentially impacting intellectual property and business-critical information.

1. Reserved2026-04-09
2. Published2026-04-16
3. EPSS updated2026-04-24

Currently, there is no specific patched version available to directly address CVE-2025-15621. As a temporary mitigation, consider implementing stricter access controls within Sparx Enterprise Architect, limiting the number of users with elevated privileges. Review and audit OpenID authentication configurations to ensure they adhere to security best practices. Monitor network traffic for suspicious OAuth2 activity. Implement a Web Application Firewall (WAF) with rules to detect and block unauthorized OAuth2 requests. Regularly review Sparx Systems' security advisories for updates and patches.