← Back to CVE Explorer

CVE-2026-13380

Full vulnerability record from the local CVENow database.

Description

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Severity
CRITICAL
CVSS score
9.0 (v4.0)
Vulnerability status
Analyzed
Source identifier
57dba5dd-1a03-47f6-8b36-e84e47d335d8
Published
2026-07-20 21:16:46.510000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON 
{
  "id": "CVE-2026-13380",
  "sourceIdentifier": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
  "published": "2026-07-20T21:16:46.510",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server."
    },
    {
      "lang": "es",
      "value": "VSee Clinic 7.1.26 y VSee Clinic API 1.3.0 expone credenciales SFTP en texto claro en las respuestas HTTP de tres puntos finales no autenticados. Las credenciales están presentes en estas respuestas solo cuando se han configurado conexiones SFTP dentro de la aplicación. No se requiere autenticación para recuperar estas credenciales. Un atacante remoto no autenticado que observa cualquiera de estas respuestas HTTP en una instancia donde SFTP está configurado puede obtener las credenciales y usarlas para acceder al servidor SFTP asociado."
    }
  ],
  "affected": [
    {
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "affectedData": [
        {
          "vendor": "VSee",
          "product": "Clinic",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "7.1.26",
              "lessThan": "7.1.26.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VSee",
          "product": "Clinic",
          "defaultStatus": "unknown",
          "modules": [
            "API"
          ],
          "versions": [
            {
              "version": "1.3.0",
              "lessThan": "1.3.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T16:38:01.040829Z",
          "id": "CVE-2026-13380",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        },
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vsee:clinic:7.1.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AD80BBB-9259-4D10-988C-26666D0CC6E8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vsee:clinic_api:1.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3A65F6C-DFDE-4938-B81E-067CB6E84D43"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://labs.sra.io/posts/vseeclinic",
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://vsee.com/clinic",
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "tags": [
        "Product"
      ]
    }
  ]
}