Sparx Pro Cloud Server stores user passwords in plaintext even when OpenID is used as the primary authentication method. This flaw allows a threat actor who can read the server's local storage or database to directly read user credentials, compromising confidentiality and potentially permitting unauthorized access to the system or other integrated services.

The vulnerability affects Sparx Systems Pty Ltd.'s Sparx Pro Cloud Server. No specific version range is listed, making all installations that rely on OpenID as the authentication method potentially vulnerable.

The flaw receives a CVSS base score of 9.3, indicating critical severity. The EPSS score is not available, and the vulnerability is not yet identified in CISA's KEV catalogue. Attackers likely need local file or database read access to the server to exploit the flaw. Once accessed, the plaintext passwords can be used to impersonate users, escalating privileges and compromising integrated services that depend on the same credentials.