CVE-2025-15099

A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is e359dc2946b12ed5e45a0ec9c95ecf91bd18502a. Applying a patch is the recommended action to fix this issue.

• CWE-287

• https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2Exploit, Third Party Advisory
• https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduceExploit, Third Party Advisory
• https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502aPatch
• https://github.com/simstudioai/sim/pull/2343Exploit, Issue Tracking
• https://vuldb.com/?ctiid.338430Permissions Required, VDB Entry
• https://vuldb.com/?id.338430Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.710255Third Party Advisory, VDB Entry
• https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduceExploit, Third Party Advisory

Published

Dec 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15093A security flaw has been discovered in sunkaifei FlyCMS up t…6.1
• CVE-2025-15094A weakness has been identified in sunkaifei FlyCMS up to abb…6.1
• CVE-2025-15095A security vulnerability has been detected in postmanlabs ht…3.5
• CVE-2025-15096The 'Videospirecore Theme Plugin' plugin for WordPress is vu…8.8
• CVE-2025-15097A vulnerability was found in Alteryx Server. Affected by thi…7.3
• CVE-2025-15098A vulnerability was determined in YunaiV yudao-cloud up to 2…6.3
• CVE-2025-1510The The Custom Post Type Date Archives plugin for WordPress …9.8
• CVE-2025-15100The JAY Login & Register plugin for WordPress is vulnerable …8.8
• CVE-2025-15101An OS command injection vulnerability in the web management …8.8
• CVE-2025-15102DVP-12SE11T - Password Protection Bypass9.8
• CVE-2025-15103DVP-12SE11T - Authentication Bypass via Partial Password Dis…9.8
• CVE-2025-15104Nu Html Checker (validator.nu) contains a restriction bypass…5.3