The vulnerability allows the client application to expose the OAuth2 client secret in plaintext. An attacker who obtains this secret can use it to request access and ID tokens through the OpenID authentication flow, effectively impersonating the legitimate client and gaining unauthorized access to protected resources.

Sparx Systems Pty Ltd. Sparx Enterprise Architect is affected. No specific version information is provided in the available data.

The CVSS score of 6.2 reflects moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require an attacker to gain local access to a system running the client or to trick a user into opening a malicious configuration that triggers the secret disclosure. Once the secret is exposed, the attacker can immediately obtain authentication tokens without further interaction.