This vulnerability (CVE-2025-15621) in Sparx Enterprise Architect 16.1.1627 relates to insufficiently protected credentials (CWE-522). Specifically, the client fails to verify the receiver of OAuth2 credentials during OpenID authentication, which may lead to credential exposure. The CVSS 4.0 base score is 5.7 (medium severity), reflecting local attack vector with high complexity and partial user interaction required. The vulnerability is published and assigned by NCSC-FI, but no remediation level or patch information is provided.

The vulnerability could allow an attacker with local access and partial user interaction to potentially intercept or misuse OAuth2 credentials due to lack of verification of the credential receiver. This may lead to credential exposure and limited impact on confidentiality and integrity. No known exploits in the wild have been reported, and the attack complexity is high, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with OAuth2/OpenID authentication flows and limit local access to trusted users. Monitor vendor communications for updates on patches or mitigations.