Read the docs
TI-2025-14249 Aliases CVE-2025-15621GHSA-g8rx-2jmm-3847

Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication

Priority LOW 24CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00106 1st percentileScored 2026-11-07
Fix Fixed Sparx Enterprise Architect (Sparx Systems Pty Ltd.): 17.1.1714

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Sparx SystemsSparx Enterprise Architect16.1.162717.1.1714Patch availableCNA
  • Sparx Enterprise Architect VendorSparx Systems Affected 16.1.1627 Fixed in 17.1.1714 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sparxsystems:enterprise_architect:*:*:*:*:*:*:*:*16.1.1627 to before 17.1.1714VulnerableSparx Systems
  • cpe:2.3:a:sparxsystems:enterprise_architect:*:*:*:*:*:*:*:* Versions 16.1.1627 to before 17.1.1714 Vulnerable ·Sparx Systems

Remediation

  • Fix · CNA Sparx Enterprise Architect (Sparx Systems Pty Ltd.) Fixed in 17.1.1714

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15621
  2. 2026-10-03 Alias added: GHSA-g8rx-2jmm-3847

References

Other 1

  • TI-2022-23300 SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences