The vulnerability is an insufficiently protected credentials issue: the client does not verify the receiver of OAuth2 credentials during OpenID authentication. This allows an attacker to intercept or redirect OAuth2 access or ID tokens, potentially gaining authentication credentials and unauthorized access.

Sparx Systems Pty Ltd. Sparx Enterprise Architect is affected. All releases are potentially impacted until a patch is applied. No specific version information is provided.

The CVSS score is 5.7, indicating moderate severity. EPSS is not available, so the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers would likely need to control or spoof the OpenID provider, or intercept traffic during the authentication flow; the attack vector is inferred from the nature of the credential misuse.