Vulnerability details
CVE-2026-13380
VSee Clinic
VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses
CVSS 4.0
9.0Critical
Official description
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.0Critical | 4.0 | CVEProject cvelistV5 (CNA) (SRA) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| VSee | Clinic | 1.3.0 ≤ v < 1.3.0.1 | CVEProject cvelistV5 (CNA) |
| VSee | Clinic | 7.1.26 ≤ v < 7.1.26.1 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://labs.sra.io/posts/vseeclinic third-party-advisory
- https://vsee.com/clinic product
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-20
- Last updated
- 2026-07-21
- State
- Published
- Assigner (CNA)
- SRA
Exploit prediction (EPSS)
0.39%
Probability of exploitation in 30 days
33.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-201Insertion of sensitive information into sent data
- CWE-312Cleartext storage of sensitive information