CVE-2026-13380 affects VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 by exposing cleartext SFTP credentials in HTTP responses from three unauthenticated endpoints. These credentials are only present if SFTP connections are configured in the application. No authentication is required to access these endpoints, enabling an unauthenticated remote attacker to retrieve the credentials and potentially access the associated SFTP server. The vulnerability is categorized under CWE-201 and CWE-312, indicating improper handling and exposure of sensitive information. There is no vendor advisory or patch information available at this time.

An unauthenticated remote attacker can obtain cleartext SFTP credentials from HTTP responses without any authentication. This exposure can lead to unauthorized access to the SFTP server configured within the VSee Clinic instance, potentially compromising sensitive data stored or transferred via that server. The CVSS 4.0 base score is 9.0, indicating a critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints if possible and avoid configuring SFTP connections in the application where exposure risk is unacceptable. Monitor for vendor updates regarding official fixes or mitigations.