CVE-2025-15622: Credential Leak in Sparx Enterprise Architect

The core of this vulnerability lies in the Sparx Enterprise Architect desktop client's handling of OAuth2 authentication. Specifically, the client decodes and stores the OAuth2 client secret in plaintext. An attacker who gains access to this plaintext secret can use it to exchange for access and ID tokens, effectively impersonating legitimate users and gaining unauthorized access to resources protected by the OAuth2 flow. This could include access to sensitive project data, collaboration features, and potentially integration with other systems relying on OAuth2 authentication. The potential blast radius depends on the sensitivity of the data accessible through Enterprise Architect and the extent of OAuth2 integration.

1. Reserved2026-04-09
2. Published2026-04-17
3. EPSS updated2026-04-24

Currently, the primary mitigation strategy is to await and apply a patch from Sparx Systems. Until a patch is available, consider restricting access to the desktop client to trusted users only. Implement multi-factor authentication (MFA) wherever possible to add an extra layer of security, even if the client secret is compromised. Monitor system logs for any unusual authentication activity or attempts to access OAuth2 endpoints. While a WAF or proxy cannot directly prevent this client-side leak, they can help detect and block subsequent malicious activity resulting from a compromised client secret.