CVE-2026-13510

SimStudioAI sim Password Protection deployment.ts weak hash

State: Published
Severity: 6.3 Medium
Published: Jun 28, 2026
Updated: Jun 29, 2026
Reserved: Jun 28, 2026

Description

A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-328 Use of Weak Hash
CWE-327 Risky Cryptographic Algorithm

Affected Products

Product	Versions
simSimStudioAI	0.6.0Affected 0.6.1Affected 0.6.2Affected 0.6.3Affected 0.6.4Affected 0.6.5Affected 0.6.6Affected 0.6.7Affected 0.6.8Affected 0.6.9Affected 0.6.10Affected 0.6.11Affected 0.6.12Affected 0.6.13Affected 0.6.14Affected 0.6.15Affected 0.6.16Affected 0.6.17Affected 0.6.18Affected 0.6.19Affected 0.6.20Affected 0.6.21Affected 0.6.22Affected 0.6.23Affected 0.6.24Affected and 68 more versions

References

VDB-374518 | SimStudioAI sim Password Protection deployment.ts weak hashvdb-entry
VDB-374518 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-13510 | CVE Analysis and Reportthird-party-advisory
Submit #838842 | Sim Studio / simstudioai sim Affected at least commit 7b572f1f61a8bbcee31fd7389097814a71f8f094; still present in origin/main commit e532e0a6da6fd22eee98310ba Improper Verification of Cryptographic Signature (CWE-347), Usethird-party-advisory
https://github.com/simstudioai/sim/issues/4759exploitissue-tracking
https://github.com/simstudioai/sim/pull/4760issue-trackingpatch
https://github.com/simstudioai/sim/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.