Executive brief
VSee Clinic, a telemedicine platform used for virtual patient visits and healthcare coordination, contains a security flaw that leaks sensitive server credentials. An attacker can access these credentials without logging in, potentially gaining full access to the SFTP server used by the clinic to store or transfer files. This could lead to the exposure of sensitive medical data or unauthorized access to the organization's file storage infrastructure.
Technical details
VSee Clinic (7.1.26) and VSee Clinic API (1.3.0) suffer from an information disclosure vulnerability where SFTP credentials (username/password) are included in cleartext within the HTTP responses of three specific endpoints. These endpoints do not require authentication, allowing any remote attacker who can reach the web interface to harvest credentials if SFTP has been configured in the application settings. This is categorized under CWE-201 (Insertion of Sensitive Information Into Sent Data) and CWE-312 (Cleartext Storage of Sensitive Information). Attackers can use these credentials to gain unauthorized access to the associated SFTP server to download or upload files. The issue is resolved in VSee Clinic version 7.1.26.1 and API version 1.3.0.1.
Affected products
- VSee Clinic 7.1.26 before 7.1.26.1
- VSee Clinic API 1.3.0 before 1.3.0.1
Timeline
- 2026-06-16: disclosed: SRA submits vulnerability to vendor
- 2026-06-24: patched: Vendor releases fix
- 2026-07-20: advisory: SRA publishes CVEs and advisory