CVE-2026-13380: VSee Clinic Credential Exposure Flaw

CVE-2026-13380 Overview

CVE-2026-13380 is an information disclosure vulnerability in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0. The application exposes cleartext Secure File Transfer Protocol (SFTP) credentials in the HTTP responses of three unauthenticated endpoints. The credentials appear in these responses only when SFTP connections have been configured within the application. An unauthenticated remote attacker who observes any of these HTTP responses can retrieve the credentials and access the associated SFTP server. The weakness is tracked as [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
An unauthenticated remote attacker can extract SFTP credentials from HTTP responses and gain access to the backend SFTP server, potentially exposing patient data stored on the telehealth platform.

Affected Products

VSee Clinic 7.1.26
VSee Clinic API 1.3.0
Deployments with SFTP connections configured within the application

Discovery Timeline

2026-07-20 - CVE-2026-13380 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-13380

Vulnerability Analysis

VSee Clinic is a telehealth platform used by healthcare providers to conduct virtual visits and exchange clinical documents. The application supports SFTP as a transport mechanism for outbound file delivery. When an administrator configures an SFTP destination, the credentials required to authenticate to that server are stored server-side. The flaw causes the application to embed those credentials directly into HTTP response bodies returned by three endpoints that do not require authentication. Any remote party who can reach the web tier can query these endpoints and read the credentials in cleartext.

Root Cause

The root cause is improper output filtering combined with missing access control. The affected endpoints serialize configuration objects that include the SFTP username and password fields. The application does not strip these sensitive fields before returning the response, and no authentication or authorization check gates the endpoints. This matches the [CWE-201] pattern where sensitive data is inserted into a transmission channel accessible to an unintended actor.

Attack Vector

Exploitation requires only network reachability to the vulnerable instance. An attacker sends unauthenticated HTTP requests to the three affected endpoints and parses the JSON response for the SFTP credential fields. With the credentials extracted, the attacker authenticates to the referenced SFTP server and reads, modifies, or deletes files hosted there. Because the credentials are legitimate, the SFTP server has no basis to distinguish attacker traffic from authorized use. See the SRA Labs Blog Post for technical details on the affected endpoints.

Detection Methods for CVE-2026-13380

Indicators of Compromise

Unauthenticated HTTP GET requests to the three affected endpoints originating from unexpected source addresses or automated scanners
SFTP authentication events on the linked file server from IP addresses that do not match the VSee Clinic host
Outbound egress from the SFTP server to attacker-controlled infrastructure following credential exposure

Detection Strategies

Inspect web server access logs for requests to the endpoints identified in the SRA Labs Blog Post and flag responses that return credential material
Deploy a data loss prevention rule on the web tier that detects SFTP credential patterns in outbound HTTP response bodies
Correlate anomalous SFTP logins with recent HTTP request activity against the VSee Clinic host to identify credential replay

Monitoring Recommendations

Enable full HTTP request and response logging on the VSee Clinic web server until a patched version is installed
Forward SFTP authentication and file transfer logs to a central log platform and alert on new source IPs
Baseline normal traffic to the API endpoints and alert on volume spikes consistent with credential harvesting

How to Mitigate CVE-2026-13380

Immediate Actions Required

Rotate all SFTP credentials configured within VSee Clinic and revoke sessions on the associated SFTP servers
Restrict network access to the VSee Clinic web tier so that only trusted client networks can reach it while a patch is pending
Audit SFTP server logs for unauthorized access attempts dating back to the deployment of the affected versions

Patch Information

No vendor patch reference was published in the NVD entry at the time of writing. Operators should consult the SRA Labs Blog Post and contact VSee directly through the VSee Clinic Overview page for remediation guidance and updated builds.

Workarounds

Remove SFTP connection configurations from VSee Clinic until a fixed version is available, since the credentials are only exposed when SFTP is configured
Place the application behind a reverse proxy or web application firewall that blocks unauthenticated requests to the three affected endpoints
Bind the SFTP server to source IP allowlists so that leaked credentials cannot be used from arbitrary networks

bash

# Example allowlist restriction using iptables on the SFTP server
iptables -A INPUT -p tcp --dport 22 -s <vsee_clinic_host_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP