Product:
SimStudio
Summary
On SimStudio versions below 0.5.74, the /api/auth/oauth/token endpoint has a vulnerability that allows an unauthenticated attacker to bypass authorization checks. By providing the credentialAccountUserId and providerId parameters, attackers can retrieve OAuth access tokens for any user. This effectively allows them to steal credentials to third-party services.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-3432 |
Exploitation
To exploit this vulnerability, an attacker needs to send a request to the /api/auth/oauth/token endpoint with valid credentialAccountUserId and providerId parameters. If successful, the attacker can obtain OAuth access tokens for any user, which can then be used to access third-party services without authorization.
Affected Products
- SimStudio versions below 0.5.74: Vulnerable to unauthorized access through the /api/auth/oauth/token endpoint.
Mitigation
To mitigate this vulnerability, it is essential to update SimStudio to version 0.5.74 or later. Additionally, implementing proper authorization checks on the /api/auth/oauth/token endpoint can help prevent unauthorized access.