This vulnerability involves the plaintext storage of locally created user passwords in Sparx Pro Cloud Server when OpenID authentication is used. The affected version is 6.0.163. The CVSS 4.0 score is 9.3 (critical), reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity. The vendor has not yet provided a remediation level or patch. The vulnerability is classified under CWE-256 (Plaintext Storage of a Password).

The plaintext storage of passwords significantly increases the risk that an attacker who gains access to the stored password data can compromise user accounts, leading to unauthorized access and potential further compromise of the system. The CVSS score of 9.3 indicates critical severity with high confidentiality and integrity impacts. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the storage location of these passwords and monitor for unauthorized access. Avoid relying solely on OpenID authentication without additional protections. Do not assume this vulnerability is mitigated without vendor confirmation.