CVE-2026-13380

Received Received - Intake

Cleartext SFTP Credentials Exposure in VSee Clinic

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Security Risk Advisors

Description

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-13380

Affected Vendors & Products

Vendor	Product	Version / Range
vsee	vsee_clinic	7.1.26
vsee	vsee_clinic_api	1.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 have a flaw where cleartext SFTP credentials are exposed in HTTP responses of three unauthenticated endpoints. This happens only if SFTP connections are configured in the application. Attackers can retrieve these credentials without authentication and use them to access the SFTP server.

Detection Guidance

Check HTTP responses from VSee Clinic endpoints for exposed SFTP credentials. Use tools like curl to inspect unauthenticated endpoints where SFTP may be configured. Example: curl -v http://<target>/api/sftp-config or similar paths.

Impact Analysis

An unauthenticated attacker could gain access to sensitive data stored on the SFTP server by exploiting this vulnerability. This could lead to data breaches, unauthorized file access, or further attacks on connected systems.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA, which mandate protection of sensitive data. Exposure of credentials may lead to unauthorized access, resulting in potential legal and regulatory penalties.

Mitigation Strategies

Disable SFTP configuration in VSee Clinic if not needed. Update to a patched version if available. Restrict network access to VSee Clinic instances to trusted users only. Monitor HTTP responses for exposed credentials.

Hi! I’m here to help you understand CVE-2026-13380. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70