CVE-2026-13380

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13380", "assignerOrgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "state": "PUBLISHED", "assignerShortName": "SRA", "dateReserved": "2026-06-25T21:22:28.646Z", "datePublished": "2026-07-20T20:11:46.703Z", "dateUpdated": "2026-07-21T17:16:05.916Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "shortName": "SRA", "dateUpdated": "2026-07-20T20:11:46.703Z"}, "title": "VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses", "datePublic": "2026-07-20T20:10:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-201", "description": "CWE-201 Insertion of sensitive information into sent data", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-312", "description": "CWE-312 Cleartext storage of sensitive information", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "affected": [{"vendor": "VSee", "product": "Clinic", "versions": [{"status": "affected", "version": "7.1.26", "lessThan": "7.1.26.1", "versionType": "semver"}], "defaultStatus": "unknown"}, {"vendor": "VSee", "product": "Clinic", "modules": ["API"], "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.3.0.1", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div>VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.</div></div>"}]}], "references": [{"url": "https://labs.sra.io/posts/vseeclinic", "tags": ["third-party-advisory"]}, {"url": "https://vsee.com/clinic", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N"}}], "credits": [{"lang": "en", "value": "Chris Jones (SRA)", "type": "finder"}, {"lang": "en", "value": "Drew Young (SRA)", "type": "finder"}, {"lang": "en", "value": "Maguire Younes (SRA)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T16:38:01.040829Z", "id": "CVE-2026-13380", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T17:16:05.916Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13380", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T16:38:01.040829Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T16:38:08.881Z"}}], "cna": {"title": "VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Chris Jones (SRA)"}, {"lang": "en", "type": "finder", "value": "Drew Young (SRA)"}, {"lang": "en", "type": "finder", "value": "Maguire Younes (SRA)"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37 Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VSee", "product": "Clinic", "versions": [{"status": "affected", "version": "7.1.26", "lessThan": "7.1.26.1", "versionType": "semver"}], "defaultStatus": "unknown"}, {"vendor": "VSee", "modules": ["API"], "product": "Clinic", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.3.0.1", "versionType": "semver"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-20T20:10:00.000Z", "references": [{"url": "https://labs.sra.io/posts/vseeclinic", "tags": ["third-party-advisory"]}, {"url": "https://vsee.com/clinic", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.", "supportingMedia": [{"type": "text/html", "value": "<div><div>VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of sensitive information into sent data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312 Cleartext storage of sensitive information"}]}], "providerMetadata": {"orgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "shortName": "SRA", "dateUpdated": "2026-07-20T20:11:46.703Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13380", "state": "PUBLISHED", "dateUpdated": "2026-07-21T17:16:05.916Z", "dateReserved": "2026-06-25T21:22:28.646Z", "assignerOrgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "datePublished": "2026-07-20T20:11:46.703Z", "assignerShortName": "SRA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Clinic", "vendor": "VSee", "versions": [{"lessThan": "7.1.26.1", "status": "affected", "version": "7.1.26", "versionType": "semver"}]}, {"defaultStatus": "unknown", "modules": ["API"], "product": "Clinic", "vendor": "VSee", "versions": [{"lessThan": "1.3.0.1", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vsee:clinic:7.1.26:*:*:*:*:*:*:*", "matchCriteriaId": "0AD80BBB-9259-4D10-988C-26666D0CC6E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:vsee:clinic_api:1.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "A3A65F6C-DFDE-4938-B81E-067CB6E84D43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server."}, {"lang": "es", "value": "VSee Clinic 7.1.26 y VSee Clinic API 1.3.0 expone credenciales SFTP en texto claro en las respuestas HTTP de tres puntos finales no autenticados. Las credenciales est\u00e1n presentes en estas respuestas solo cuando se han configurado conexiones SFTP dentro de la aplicaci\u00f3n. No se requiere autenticaci\u00f3n para recuperar estas credenciales. Un atacante remoto no autenticado que observa cualquiera de estas respuestas HTTP en una instancia donde SFTP est\u00e1 configurado puede obtener las credenciales y usarlas para acceder al servidor SFTP asociado."}], "id": "CVE-2026-13380", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13380", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T16:38:01.040829Z", "version": "2.0.3"}}]}, "published": "2026-07-20T21:16:46.510", "references": [{"source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "tags": ["Third Party Advisory"], "url": "https://labs.sra.io/posts/vseeclinic"}, {"source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "tags": ["Product"], "url": "https://vsee.com/clinic"}], "sourceIdentifier": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-312"}], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.26,7.1.26.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Clinic", "source": "cna", "vendor": "VSee"}, "product": "clinic", "vendor": "vsee"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.0,1.3.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Clinic", "source": "cna", "vendor": "VSee"}, "product": "clinic", "vendor": "vsee"}], "created": "2026-07-21T20:00:06.348043+00:00", "updated": "2026-08-01T07:15:03.367712+00:00", "vendors": ["vsee", "vsee$PRODUCT$clinic"]}