CVE-2026-13380 in Clinic
Summary
by MITRE • 07/21/2026
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability represents a critical security flaw in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 where sensitive authentication credentials are inadvertently exposed through HTTP responses without requiring any form of authentication. The issue manifests specifically when SFTP connections have been configured within the application, making it particularly dangerous for organizations that utilize secure file transfer protocols for their medical data handling. The exposure occurs through three distinct unauthenticated endpoints that return cleartext credentials in their response payloads, effectively eliminating any barrier between potential attackers and sensitive authentication information.
The technical implementation of this vulnerability stems from improper handling of SFTP credential storage and transmission within the application's HTTP response mechanisms. When SFTP connections are configured, the system stores these credentials in a manner that allows them to be retrieved through HTTP requests without requiring authentication or authorization checks. This design flaw directly violates fundamental security principles regarding credential management and access control, as it exposes sensitive information through publicly accessible endpoints. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information) and CWE-200 (Information Exposure) according to the Common Weakness Enumeration catalog, demonstrating the severity of storing and transmitting authentication credentials in an unencrypted format.
The operational impact of this vulnerability extends beyond simple credential theft, as it creates a pathway for unauthorized access to sensitive medical data stored on remote SFTP servers. Attackers can leverage this exposure to gain persistent access to healthcare information systems, potentially compromising patient privacy and violating regulations such as HIPAA compliance requirements. The unauthenticated nature of the attack means that any individual with network access to the vulnerable system can exploit this flaw without requiring prior credentials or authentication. This creates a significant risk for healthcare organizations that rely on VSee Clinic for telemedicine services, where sensitive patient data is frequently transferred through SFTP connections.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities from occurring in the future. Organizations should immediately implement network segmentation to restrict access to these endpoints and ensure that SFTP configurations are properly secured at the application level. The recommended approach involves modifying the HTTP response handling to strip or encrypt any credential information before transmission, while also implementing proper authentication checks for all endpoints that may return sensitive data. Additionally, organizations should conduct comprehensive security testing of all application components to identify similar credential exposure vulnerabilities and ensure compliance with industry standards such as those outlined in the MITRE ATT&CK framework where this vulnerability would be categorized under T1566 (Phishing) and T1071.5 (Application Layer Protocol: Web Protocols) for exploitation techniques.