CVE-2026-3432
On SimStudio version below to 0.5.74, the endpoint contains a code path that bypasses all authorization checks when provided with and parameters.
Published Mar 2, 2026 · updated Jun 17, 2026 · sim sim
On SimStudio version below to 0.5.74, the endpoint contains a code path that bypasses all authorization checks when provided with and parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 2, 2026 · NIST NVD
Detected
On SimStudio version below to 0.5.74, the endpoint contains a code path that bypasses all authorization checks when provided with and parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
Jun 17, 2026 · NIST NVD
Updated
On SimStudio version below to 0.5.74, the endpoint contains a code path that bypasses all authorization checks when provided with and parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
Affected
- cpe sim/simversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-3432
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3432
On SimStudio version below to 0.5.74, the endpoint contains a code path that bypasses all authorization checks when provided with and parameters. An unauthenticated attacker can retrieve OAuth access tokens for any us
nvd.nist.gov