CVE-2026-3432
Authorization Bypass in SimStudio OAuth Endpoint Enables Token Theft
Publication date: 2026-03-02
Last updated on: 2026-03-06
Assigner: Tenable Network Security, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sim | sim | to 0.5.74 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-3432 is a critical security vulnerability in Sim Studio AI versions prior to 0.5.74. It exists in the `/api/auth/oauth/token` endpoint, where a specific code path bypasses all authorization checks if the parameters `credentialAccountUserId` and `providerId` are provided.'}, {'type': 'paragraph', 'content': "This flaw allows an unauthenticated attacker to supply any user's ID and a provider name to retrieve OAuth access tokens for that user without needing to authenticate. Essentially, the attacker can steal OAuth tokens and gain unauthorized access to third-party services linked to those tokens."}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows attackers to remotely obtain OAuth access tokens for any user without authentication or user interaction.
- Attackers can impersonate users and access third-party services linked to the stolen tokens.
- Confidentiality and integrity of user credentials and linked services are compromised.
- Unauthorized access can lead to data breaches, service misuse, and potential further exploitation of connected systems.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users of Sim Studio AI should upgrade their software to version 0.5.74 or later, as this version contains the fix for the issue.