CVE-2026-13510: fallo de gravedad media en SimStudioAI sim
SimStudioAI sim Password Protection deployment.ts weak hash
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.3epss 0.3%
A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
SimStudioAI · simPoCs públicas encontradas — 1
cve_referencegithub.com/simstudioai/sim/issues/4759no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — SimStudioAI sim
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-7107MEDIUMSimStudioAI sim route.ts handleLocalFile path traversalEPSS 0.9%CVE-2025-10097MEDIUMSimStudioAI sim route.ts code injectionEPSS 0.8%CVE-2025-9801MEDIUMSimStudioAI sim path traversalEPSS 0.8%CVE-2025-7114MEDIUMSimStudioAI sim Session route.ts POST missing authenticationEPSS 0.6%CVE-2026-3431CRITICALSim Studio AI - MongoDB SSRF and Arbitrary Document DeletionEPSS 0.4%CVE-2026-3432CRITICALSim Studio AI - Unauthenticated OAuth Token TheftEPSS 0.3%