CVE-2026-3432
Sim Studio AI - Unauthenticated OAuth Token Theft
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
| CWE | CWE-862 |
| Vendor | simstudioai |
| Product | sim |
| Published | Mar 2, 2026 |
| Last Updated | Mar 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for simstudioai sim
Be the first to know when new unknown vulnerabilities affecting simstudioai sim are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
SimStudioAI / sim
0 < 0.5.74