CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://labs.sra.io/posts/vseeclinic	Third Party Advisory
https://vsee.com/clinic	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vsee:clinic:7.1.26:::::::*
	cpe:2.3:a:vsee:clinic_api:1.3.0:::::::*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) VSee Clinic 7.1.26 y VSee Clinic API 1.3.0 expone credenciales SFTP en texto claro en las respuestas HTTP de tres puntos finales no autenticados. Las credenciales están presentes en estas respuestas solo cuando se han configurado conexiones SFTP dentro de la aplicación. No se requiere autenticación para recuperar estas credenciales. Un atacante remoto no autenticado que observa cualquiera de estas respuestas HTTP en una instancia donde SFTP está configurado puede obtener las credenciales y usarlas para acceder al servidor SFTP asociado.

Information

Published : 2026-07-20 21:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-13380

Mitre link : CVE-2026-13380

CVE.ORG link : CVE-2026-13380

JSON object : View

Products Affected

vsee

clinic
clinic_api

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2026-13380", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13380", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T16:38:01.040829Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "affectedData": [{"vendor": "VSee", "product": "Clinic", "versions": [{"status": "affected", "version": "7.1.26", "lessThan": "7.1.26.1", "versionType": "semver"}], "defaultStatus": "unknown"}, {"vendor": "VSee", "modules": ["API"], "product": "Clinic", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.3.0.1", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-07-20T21:16:46.510", "references": [{"url": "https://labs.sra.io/posts/vseeclinic", "tags": ["Third Party Advisory"], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}, {"url": "https://vsee.com/clinic", "tags": ["Product"], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "description": [{"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server."}, {"lang": "es", "value": "VSee Clinic 7.1.26 y VSee Clinic API 1.3.0 expone credenciales SFTP en texto claro en las respuestas HTTP de tres puntos finales no autenticados. Las credenciales est\u00e1n presentes en estas respuestas solo cuando se han configurado conexiones SFTP dentro de la aplicaci\u00f3n. No se requiere autenticaci\u00f3n para recuperar estas credenciales. Un atacante remoto no autenticado que observa cualquiera de estas respuestas HTTP en una instancia donde SFTP est\u00e1 configurado puede obtener las credenciales y usarlas para acceder al servidor SFTP asociado."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vsee:clinic:7.1.26:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AD80BBB-9259-4D10-988C-26666D0CC6E8"}, {"criteria": "cpe:2.3:a:vsee:clinic_api:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3A65F6C-DFDE-4938-B81E-067CB6E84D43"}], "operator": "OR"}]}], "sourceIdentifier": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}