CVE-2025-15624

BRIEFING NOTE: CVE-2025-15624 Sparx Systems Pty Ltd. Sparx Pro Cloud Server contains a plaintext password storage vulnerability affecting environments where OpenID is configured as the primary authentication method. When users authenticate via OpenID, the server creates and stores local passwords in plaintext rather than using secure storage mechanisms, creating a significant data protection risk. The vulnerability presents a direct access vector with low complexity, as attackers with access to the server or its data stores can trivially retrieve plaintext credentials without requiring authentication or exploitation techniques. The primary impact is confidentiality compromise, as captured passwords could enable unauthorized account access and lateral movement within the environment. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community attention with an EPSS score of 0.00025, indicating low real-world exploitation likelihood to date. No active exploitation has been reported, and the vulnerability remains in an inactive status on public tracking lists; however, organizations using OpenID authentication with Sparx Pro Cloud Server should prioritize remediation to prevent opportunistic exploitation following broader disclosure.