PT-2025-53443 · Unknown · Simstudioai Sim

28Hus · Published 2025-12-26 · Updated 2026-01-08 · CVE-2025-15099

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions simstudioai sim versions prior to 0.5.27

Description A flaw exists in simstudioai sim up to version 0.5.27 related to improper authentication. The issue resides within the CRON Secret Handler component, specifically in the file apps/sim/lib/auth/internal.ts. Manipulation of the INTERNAL API SECRET argument can lead to unauthorized access. The exploit is publicly available.

Recommendations Apply the patch with identifier e359dc2946b12ed5e45a0ec9c95ecf91bd18502a.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-15099

Affected Products

Simstudioai Sim

References · 15

• 🔥 https://github.com/simstudioai/sim/pull/2343 · Exploit
• 🔥 https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2 · Exploit
• 🔥 https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduce · Exploit
• https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-15099 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15099 · Vendor Advisory
• https://t.me/CVEtracker/40694 · Telegram Post
• https://t.me/cveNotify/148138 · Telegram Post
• https://vuldb.com/?id.338430 · Note
• https://vuldb.com/?submit.710255 · Note
• https://twitter.com/CVEnew/status/2004457728354537896 · Twitter Post
• https://vuldb.com/?ctiid.338430 · Note
• https://twitter.com/cracbot/status/2006319469065572604 · Twitter Post
• https://t.me/cveNotify/146883 · Telegram Post
• https://t.me/cveNotify/146854 · Telegram Post