External risk intelligence

VSee Clinic Cleartext SFTP Credential Disclosure

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-13380

VSee Clinic is a public-facing telehealth platform designed to be accessed over the internet by patients and providers. As a web-based service, its endpoints are exposed to the public internet by design to facilitate remote clinical consultations, making the vulnerable HTTP endpoints highly likely to be reachable by external actors.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in VSee Clinic software that could allow unauthenticated remote attackers to gain access to SFTP server credentials. The vulnerability stems from cleartext transmission of these credentials within HTTP responses, accessible through unauthenticated endpoints when SFTP is configured. This exposure poses a risk of unauthorized access to sensitive data stored on the SFTP server.

Unprotected credentials may be exposed.
This allows unauthorized SFTP server access.
Confirm relevance and assess exposure risks.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by observing unauthenticated HTTP responses from VSee Clinic instances where SFTP has been configured. These responses inadvertently contain cleartext SFTP credentials, which the attacker can then use to gain unauthorized access to the associated SFTP server.

Entry: Unauthenticated network access.
Trigger: Observing specific HTTP responses.
Risk: Unauthorized SFTP server access.

Live Threat

Current exploitation, exposure, and threat context

SFTP credentials could be exposed in cleartext HTTP responses when SFTP is configured in VSee Clinic, allowing unauthenticated remote attackers to access the SFTP server.

Exposed SFTP credentials.
Unauthenticated HTTP response observation.
Unauthorized SFTP server access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in VSee Clinic exposes SFTP credentials through unauthenticated API endpoints, posing a significant risk if SFTP is configured. Responsibility likely falls to application owners and platform teams to identify affected instances, assess business criticality and network exposure, and coordinate remediation with the vendor.

Application owners, with vendor support.
Verify SFTP configuration and network reachability.
Plan vendor-coordinated remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is VSee Clinic?

VSee Clinic is a telehealth platform used by healthcare providers and patients for remote clinical consultations. It functions as a web-based service, typically involving a front-end interface and an API backend that manages data flows, including connections to external storage systems like SFTP servers used for handling medical records or patient documentation.

How does CVE-2026-13380 reveal sensitive data?

This vulnerability involves the improper storage and transmission of sensitive information, specifically cleartext SFTP credentials. It falls under the weakness classes of CWE-201 (Insertion of Sensitive Information into Sent Data) and CWE-312 (Cleartext Storage of Sensitive Information). Essentially, the software inadvertently includes these login credentials within the body of HTTP responses sent to users, even when those users are not logged in.

When does this vulnerability trigger?

The issue occurs when an unauthenticated user accesses specific API endpoints on a VSee Clinic instance. Crucially, the bug only triggers if SFTP connectivity has been configured within the application settings; if the system is not using SFTP for data transfers, these specific credentials do not exist in the response, and the vulnerability is not present.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that VSee Clinic is highly likely to be reachable by external actors because the platform is designed as a public-facing service for internet-based consultations. Because the vulnerable endpoints are exposed to the internet by default to support these remote sessions, any instance configured with SFTP should be treated as potentially reachable by an attacker.

What should I do to address this issue?

Begin by auditing your current VSee Clinic configuration to determine if SFTP services are enabled. If you identify that SFTP is in use, prioritize contacting the vendor for the official patch or remediation guidance. In the interim, evaluate whether the SFTP integration is strictly necessary and work with your platform team to assess the risk to the backend systems that those credentials protect.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.