This vulnerability involves the plaintext storage of user passwords in Sparx Pro Cloud Server when OpenID is used as the primary authentication method. The server generates local passwords for users and stores them without encryption or hashing, violating secure credential storage best practices (CWE-256). This exposure could allow attackers who gain access to the storage medium to retrieve user passwords directly. The vulnerability affects version 6.0.163 of the product. No vendor advisory or patch information is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

The impact of this vulnerability is the potential disclosure of user passwords in plaintext, which could lead to unauthorized access to user accounts if an attacker obtains the stored password data. Given the critical CVSS score of 9.3, the vulnerability poses a severe risk to confidentiality and potentially integrity of user authentication. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting access to the storage location of these passwords and monitor for unauthorized access. Avoid relying solely on OpenID authentication without additional security controls. Follow updates from Sparx Systems Pty Ltd. for any forthcoming patches or official mitigations.