CVE-2026-13510: A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core...

Description

A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1

3.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0

2.9/10

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.22%

11.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
SimStudioAI	sim	0.6.0; 0.6.1; 0.6.2; 0.6.3; 0.6.4; 0.6.5; 0.6.6; 0.6.7; 0.6.8; 0.6.9; 0.6.10; 0.6.11; 0.6.12; 0.6.13; 0.6.14; 0.6.15; 0.6.16; 0.6.17; 0.6.18; 0.6.19; 0.6.20; 0.6.21; 0.6.22; 0.6.23; 0.6.24; 0.6.25; 0.6.26; 0.6.27; 0.6.28; 0.6.29; 0.6.30; 0.6.31; 0.6.32; 0.6.33; 0.6.34; 0.6.35; 0.6.36; 0.6.37; 0.6.38; 0.6.39; 0.6.40; 0.6.41; 0.6.42; 0.6.43; 0.6.44; 0.6.45; 0.6.46; 0.6.47; 0.6.48; 0.6.49; 0.6.50; 0.6.51; 0.6.52; 0.6.53; 0.6.54; 0.6.55; 0.6.56; 0.6.57; 0.6.58; 0.6.59; 0.6.60; 0.6.61; 0.6.62; 0.6.63; 0.6.64; 0.6.65; 0.6.66; 0.6.67; 0.6.68; 0.6.69; 0.6.70; 0.6.71; 0.6.72; 0.6.73; 0.6.74; 0.6.75; 0.6.76; 0.6.77; 0.6.78; 0.6.79; 0.6.80; 0.6.81; 0.6.82; 0.6.83; 0.6.84; 0.6.85; 0.6.86; 0.6.87; 0.6.88; 0.6.89; 0.6.90; 0.6.91; 0.6.92

References

Timeline

Published: Jun 28, 2026
Last Modified: Jun 29, 2026
Status: Deferred

Frequently Asked Questions

What is CVE-2026-13510?

A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

How severe is CVE-2026-13510?

CVE-2026-13510 has a CVSS score of 3.7/10 (LOW severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2026-13510?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Related CVEs from 2026

View all 2026CVEs →