CVEvulnerability

CVE-2026-13380

9.0 CRITICAL Published 2026-07-20 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-07-20
Last modified
2026-10-24
Assigner
57dba5dd-1a03-47f6-8b36-e84e47d335d8
CVSS 4.0 (57dba5dd-1a03-47f6-8b36-e84e47d335d8)
9.0 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-201, CWE-312

Description

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Affected configurations

• vsee clinic 7.1.26 • vsee clinic api 1.3.0

Related

Weakness · CWE (2)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References