Sparx Systems Sparx Enterprise Architect Insufficiently Protected Credentials Vulnerability

A vulnerability in Sparx Systems Sparx Enterprise Architect allows the desktop client to access plaintext OAuth2 client secrets. This secret is then used to obtain access and ID tokens during the OpenID authentication process. The issue arises from inadequate protection of credentials, exposing sensitive information that can be exploited in the authentication flow.

Impact

Exploitation of this vulnerability leads to unauthorized access tokens being obtained, which could allow for impersonation or access to resources on behalf of the user.