This vulnerability (CVE-2025-15622) in Sparx Enterprise Architect version 16.1.1627 is classified under CWE-522 (Insufficiently Protected Credentials). The desktop client exposes the OAuth2 client secret in plaintext, which it then decodes and uses to obtain access and ID tokens as part of the OpenID authentication process. The CVSS 4.0 base score is 6.2 (medium severity), reflecting local attack vector with low complexity and no required privileges or user interaction. The vulnerability could allow an attacker with local access to obtain sensitive OAuth2 credentials, potentially impacting confidentiality and integrity of authentication tokens. No vendor advisory or patch information is currently available.

The impact is that an attacker with local access to the affected client version could retrieve the plaintext OAuth2 client secret. This secret is used to obtain access and ID tokens, which could lead to unauthorized access if misused. However, exploitation requires local access and the vulnerability has a medium severity rating. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, users should monitor Sparx Systems' advisories for updates. Until a fix is available, limit local access to affected systems and consider additional controls around OAuth2 client secret storage and usage.