Is CVE-2026-13510 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13510 being exploited in the wild.

How severe is CVE-2026-13510?

Low severity, with a CVSS score of 3.7, published 28 June 2026.

Is there a fix for CVE-2026-13510?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13510 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13510?

Check whether you run SimStudioAI Sim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13510: SimStudioAI sim authentication bypass via forged tokens in Password Protection Handler

CVE-2026-13510 · Severity: low · CVSS 3.7 · Published 2026-06-28

SimStudioAI Sim is a platform used to build and manage AI agents. A security flaw in how the system handles password-protected deployments allows unauthorized users to bypass security checks and access private AI chat or form interfaces. By guessing a short, weak piece of security data, an attacker can create their own access tokens to view sensitive deployment configurations and interact with protected agents.

Technologies: SimStudioAI Sim. Vendors: SimStudioAI.

Quick answers

Is CVE-2026-13510 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13510 being exploited in the wild.
How severe is CVE-2026-13510?: Low severity, with a CVSS score of 3.7, published 28 June 2026.
Which products and versions are affected?: SimStudioAI Sim up to 0.6.92.
Is there a fix for CVE-2026-13510?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13510 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13510?: Check whether you run SimStudioAI Sim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Password Protection Handler within `apps/sim/lib/core/security/deployment.ts` of SimStudioAI sim. The `validateAuthToken` function relies on a base64-encoded token containing a 32-bit truncated SHA-256 hash of the deployment password. Because these tokens are not signed with a server-side secret (HMAC), an attacker can forge valid authentication cookies by brute-forcing the 8-character hex hash (32-bit search space). Successful exploitation allows unauthorized remote access to password-protected chat and form deployments, including the ability to retrieve full deployment configurations via GET requests. A pull request (#4760) has been submitted to implement HMAC-signed tokens.

Affected products

SimStudioAI sim up to 0.6.92

Timeline

2026-05-27: disclosed: Issue reported on GitHub and fix proposed via pull request
2026-06-28: advisory: CVE-2026-13510 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.