PT-2026-22583 · Simstudio · Simstudio

Publicado 2026-03-02 · Atualizado 2026-03-07 · CVE-2026-3432

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SimStudio versions prior to 0.5.74

Description The /api/auth/oauth/token endpoint in SimStudio has a code path that circumvents authorization checks when provided with the credentialAccountUserId and providerId parameters. An unauthenticated attacker can obtain OAuth access tokens for any user by providing their user ID and a provider name, potentially compromising credentials to third-party services.

Recommendations Update SimStudio to version 0.5.74 or later. As a temporary workaround, restrict access to the /api/auth/oauth/token endpoint.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-3432

Produtos afetados

Simstudio

Referências · 9

• https://twitter.com/dailycve/status/2030069081332646302 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2028478023809339514 · Publicação no Twitter
• https://t.me/CVEtracker/46120 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-3432 · Aviso do Fabricante
• https://tenable.com/security/research/tra-2026-13 · Nota
• https://twitter.com/cracbot/status/2030237087937835231 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3432 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2028478105120104628 · Publicação no Twitter
• https://t.me/cveNotify/153718 · Publicação no Telegram