Cleartext SFTP Credentials Exposed in VSee Clinic and API
CVE-2026-13380

9CRITICAL

Key Information:

Vendor

Vsee

Status
Clinic
Vendor
CVE Published:
20 July 2026

What is CVE-2026-13380?

VSee Clinic versions 7.1.26 and the VSee Clinic API 1.3.0 reveal SFTP credentials in cleartext through HTTP responses from three unauthenticated endpoints. This vulnerability occurs when SFTP configurations are present within the application. Due to the lack of authentication required to access these responses, an attacker monitoring these interactions can easily obtain sensitive credentials, potentially compromising the associated SFTP server.

Affected Version(s)

Clinic 7.1.26 < 7.1.26.1

Clinic 1.3.0 < 1.3.0.1

References

https://labs.sra.io/posts/vseeclinic
third-party-advisory
https://vsee.com/clinic
product

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Jones (SRA)
Drew Young (SRA)
Maguire Younes (SRA)
.