What’s Vulnerable › Vulnerabilities

CVE-2025-15621: Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication

• Severity: medium (CVSS 6.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-16 · updated 2026-10-07
• Weakness: CWE-522

Description

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

Affected products

• Sparx Systems Enterprise Architect: from 16.1.1627 before 17.1.1714 — fixed in 17.1.1714

How to fix

Upgrade to a fixed version: Sparx Systems Enterprise Architect 17.1.1714. Check the vendor advisory for mitigations.

References

• https://sparxsystems.com/products/ea/17.1/history.html

Get alerted when CVE-2025-15621 or the next vulnerability affects your stack