Vulnerability · Published Jul 20, 2026 · Assigned by SRA
CVE-2026-13380VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses
Critical 9.0
In plain English
A critical-severity security flaw in Clinic from VSee. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.
Affected products (as reported)
Weakness: CWE-201, CWE-312 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
References
- https://labs.sra.io/posts/vseeclinic third-party-advisory
- https://vsee.com/clinic product