CVE-2026-13510
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was found in SimStudioAI sim up to version 0.6.92 in the password protection handler component (apps/sim/lib/core/security/deployment.ts). Manipulation leads to use of a weak hash, enabling a remote attack with high complexity. The exploit has been made public and a fix is pending.
Risk Assessment
The organization is at risk of remote account takeover or data access through weak password hash cracking. Although the attack is difficult, the public exploit increases the likelihood of exploitation.
Recommendation
Immediately update SimStudioAI sim to a version above 0.6.92 once the fix is released. Until then, implement additional password protection mechanisms, such as stronger hashing.
Other vulnerabilities in SimStudioAI sim
See all- CVE-2025-10097Medium
A vulnerability was identified in SimStudioAI sim up to 1.0.0. This impacts an unknown function of the file apps/sim/app/api/function/execute/route.ts. The manipulation of the argument code leads to code injection. The attack is possible to be carried out remotely.
- CVE-2025-9800Medium
A vulnerability was identified in SimStudioAI sim up to commit ed9b9ad83f1a7c61f4392787fb51837d34eeb0af, specifically in the Import function of the file apps/sim/app/api/files/upload/route.ts (HTML File Parser component). Manipulation of the File argument can lead to unrestricted upload. The attack may be launched remotely, and the exploit is publicly available. The product operates on a rolling release basis, so no version details are available. The patch is identified as 45372aece5e05e04b417442417416a52e90ba174.
Original NVD description (English source)
A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS