Skip to content
OpenAdvisories

Product · SimStudioAI

sim

12 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-3432

    Sim Studio AI - Unauthenticated OAuth Token Theft

    On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth acc…

    SimStudioAI sim
  • Critical 9.8
    CVE-2026-3431

    Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

    On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perf…

    SimStudioAI sim