What’s Vulnerable › Vulnerabilities

CVE-2026-13380: VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-10-24
• Weakness: CWE-201

Description

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Affected products

• VSee Clinic: 7.1.26
• VSee Clinic Api: 1.3.0

References

• https://labs.sra.io/posts/vseeclinic
• https://vsee.com/clinic

Get alerted when CVE-2026-13380 or the next vulnerability affects your stack