Weak Hash in SimStudioAI SIM Application

Publication date: 2026-06-28

Last updated on: 2026-06-28

Assigner: VulDB

Description

A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-28

Last Modified

2026-06-28

Generated

2026-06-29

AI Q&A

2026-06-29

EPSS Evaluated

N/A

NVD

CVE-2026-13510

EUVD

EUVD-2026-40007

Affected Vendors & Products

Vendor	Product	Version / Range
simstudioai	sim	to 0.6.92 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-327	The product uses a broken or risky cryptographic algorithm or protocol.
CWE-328	The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Attack-Flow Graph

Executive Summary

This vulnerability exists in SimStudioAI sim up to version 0.6.92, specifically in an unknown functionality within the Password Protection Handler component located in the library apps/sim/lib/core/security/deployment.ts. The issue involves the use of a weak hash due to manipulation, which can be exploited remotely. Although the attack complexity is high and exploitation is difficult, the exploit has been made public. A fix has been proposed but is not yet accepted.

Impact Analysis

The vulnerability allows an attacker to remotely exploit the use of a weak hash in the password protection mechanism. This could potentially weaken the security of password handling, making it easier for attackers to compromise password-related data or authentication processes. However, the attack complexity is high and exploitation is difficult, which may limit the likelihood of successful attacks.

Hi! I’m here to help you understand CVE-2026-13510. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70