by Kastro
Paper/Archive/CVE-2026-13380

CVE-2026-13380

VSee Clinic — VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses

EPSS 0.4%CVSS 9.0
critical.is priorityof 100
34
CVSS 9.0 (CNA)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 33.5.335 × 206.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Affected

ProductAffectedFixed inSource
Clinic7.1.26 – < 7.1.26.17.1.26.1CNA
Clinic1.3.0 – < 1.3.0.11.3.0.1CNA

Scores by source

SRA (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeuplabs.sra.io/posts/vseeclinicrefvsee.com/clinic