This vulnerability (CVE-2025-15622) affects Sparx Enterprise Architect 16.1.1627 and is classified under CWE-522 (Insufficiently Protected Credentials). The issue arises because the desktop client reveals the OAuth2 client secret in plaintext, which it decodes and uses to obtain access and ID tokens during the OpenID authentication process. The CVSS 4.0 score is 6.2 (medium severity), reflecting local attack vector with low complexity, no privileges or user interaction required, but with low confidentiality and integrity impact and some availability impact. No official remediation or patch has been documented as of the publication date.

The impact of this vulnerability is that an attacker with local access could potentially obtain the plaintext OAuth2 client secret from the desktop client. This could allow the attacker to exchange the secret for access and ID tokens, potentially leading to unauthorized access to resources protected by OpenID authentication. However, the attack requires local access and the vulnerability has not been reported to be exploited in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level has been provided by Sparx Systems Pty Ltd., users should monitor vendor communications for updates. Until a fix is available, restricting local access to trusted users and environments is advisable to reduce risk.