Skip to main content

Sim CVE-2025-15099

MEDIUM
Improper Authentication (CWE-287)
2025-12-26 cna@vuldb.com
Authentication Bypass Sim
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 26, 2026 - 16:11 vuln.today
Analysis Generated
Jul 26, 2026 - 16:11 vuln.today
CVE Published
Dec 26, 2025 - 04:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is e359dc2946b12ed5e45a0ec9c95ecf91bd18502a. Applying a patch is the recommended action to fix this issue.

AnalysisAI

Improper authentication in Sim's CRON secret handler allows attackers to bypass authentication on internal APIs and CRON endpoints when required environment secrets are not configured. Publicly available exploit code exists, and the issue affects Sim versions up to 0.5.27. Attackers can remotely access sensitive internal operations by providing an empty or arbitrary secret token.

More in Sim

View all
CVE-2026-3431 CRITICAL
9.8 Mar 02

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary

CVE-2025-7114 MEDIUM POC
5.5 Jul 07

Missing authentication in the file upload API endpoint of SimStudioAI Sim allows remote unauthenticated attackers to upl
CVE-2025-7107 MEDIUM POC
5.3 Jul 07

A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLo
CVE-2025-10097 MEDIUM POC
5.3 Sep 08

A vulnerability was identified in SimStudioAI sim up to 1.0.0. Rated medium severity (CVSS 5.3), this vulnerability is r
CVE-2026-3432 CRITICAL
9.1 Mar 02

SimStudio has a second authorization flaw in the OAuth token endpoint that allows privilege escalation through crafted t
CVE-2026-13510 LOW POC
2.9 Jun 28

Deployment authentication token weakness in SimStudioAI Sim up to 0.6.92 leaks a truncated SHA-256 derivative of the enc

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-15099 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy