CVE-2026-13380 PUBLISHED

VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses

Assigner: SRA
Reserved: 25.06.2026 Published: 20.07.2026 Updated: 20.07.2026

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS Score: 9

Product Status

Vendor VSee
Product Clinic
Versions Default: unknown
  • affected from 7.1.26 to 7.1.26.1 (excl.)
Vendor VSee
Product Clinic
Versions Default: unknown
  • affected from 1.3.0 to 1.3.0.1 (excl.)

Credits

  • Chris Jones (SRA) finder
  • Drew Young (SRA) finder
  • Maguire Younes (SRA) finder

References

Problem Types

  • CWE-201 Insertion of sensitive information into sent data CWE
  • CWE-312 Cleartext storage of sensitive information CWE

Impacts

  • CAPEC-37 Retrieve Embedded Sensitive Data