# CVE-2026-13510: SimStudioAI sim authentication bypass via forged tokens in Password Protection Handler

Source: https://junglewise.ai/threats/cve-2026-13510-simstudioai-sim-authentication-bypass-via-forged-tokens-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-28. Updated: 2026-06-28  
License: CC BY 4.0 with a link back

CVE-2026-13510 · Severity: low · CVSS 3.7 · Published 2026-06-28

SimStudioAI Sim is a platform used to build and manage AI agents. A security flaw in how the system handles password-protected deployments allows unauthorized users to bypass security checks and access private AI chat or form interfaces. By guessing a short, weak piece of security data, an attacker can create their own access tokens to view sensitive deployment configurations and interact with protected agents.

Technologies: [SimStudioAI Sim](https://junglewise.ai/threats/technologies/sim). Vendors: [SimStudioAI](https://junglewise.ai/threats/vendors/simstudioai).

## Quick answers

**Is CVE-2026-13510 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13510 being exploited in the wild.

**How severe is CVE-2026-13510?** Low severity, with a CVSS score of 3.7, published 28 June 2026.

**Which products and versions are affected?** SimStudioAI Sim up to 0.6.92.

**Is there a fix for CVE-2026-13510?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13510 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13510?** Check whether you run SimStudioAI Sim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Password Protection Handler within `apps/sim/lib/core/security/deployment.ts` of SimStudioAI sim. The `validateAuthToken` function relies on a base64-encoded token containing a 32-bit truncated SHA-256 hash of the deployment password. Because these tokens are not signed with a server-side secret (HMAC), an attacker can forge valid authentication cookies by brute-forcing the 8-character hex hash (32-bit search space). Successful exploitation allows unauthorized remote access to password-protected chat and form deployments, including the ability to retrieve full deployment configurations via GET requests. A pull request (#4760) has been submitted to implement HMAC-signed tokens.

## Affected products

- SimStudioAI sim up to 0.6.92

## Timeline

- 2026-05-27: disclosed: Issue reported on GitHub and fix proposed via pull request
- 2026-06-28: advisory: CVE-2026-13510 published

## References

- [https://github.com/simstudioai/sim/](https://github.com/simstudioai/sim/)
- [https://github.com/simstudioai/sim/issues/4759](https://github.com/simstudioai/sim/issues/4759)
- [https://github.com/simstudioai/sim/pull/4760](https://github.com/simstudioai/sim/pull/4760)
- [https://vuldb.com/cve/CVE-2026-13510](https://vuldb.com/cve/CVE-2026-13510)
- [https://vuldb.com/submit/838842](https://vuldb.com/submit/838842)
- [https://vuldb.com/vuln/374518](https://vuldb.com/vuln/374518)
- [https://vuldb.com/vuln/374518/cti](https://vuldb.com/vuln/374518/cti)

## Related threats

- [SimStudioAI code injection in function execution endpoint](https://junglewise.ai/threats/cve-2025-10097-simstudioai-code-injection-in-function-execution-endpoint)