CVE-2026-13380 is a critical vulnerability in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 that involves the insertion of sensitive information (cleartext SFTP credentials) into HTTP responses from three unauthenticated endpoints. This exposure occurs only when SFTP is configured in the application. Because no authentication is required to retrieve these credentials, an unauthenticated remote attacker can obtain them and use them to access the SFTP server, potentially compromising data confidentiality.

The exposure of cleartext SFTP credentials without authentication allows an unauthenticated remote attacker to gain unauthorized access to the SFTP server configured within the VSee Clinic application. This can lead to unauthorized data access or manipulation on the SFTP server. The CVSS 4.0 score of 9 indicates a critical severity with high confidentiality impact and no required privileges or user interaction.

No official patch or remediation level has been provided by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict network access to the vulnerable endpoints and monitor for unauthorized access attempts. Avoid configuring SFTP connections if not necessary, or consider alternative secure file transfer methods. Follow vendor updates closely for an official fix.