{"id":"CVE-2026-13510","summary":"SimStudioAI sim Password Protection deployment.ts weak hash","details":"A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.","modified":"2026-08-12T03:51:26.650972180Z","published":"2026-06-28T22:15:11.256Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13510.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.6.0"},{"last_affected":"0.6.0"},{"introduced":"0.6.57"},{"last_affected":"0.6.57"},{"introduced":"0.6.70"},{"last_affected":"0.6.70"},{"introduced":"0.6.74"},{"last_affected":"0.6.74"}]}],"cna_assigner":"VulDB","cwe_ids":["CWE-327","CWE-328"]},"references":[{"type":"WEB","url":"https://github.com/simstudioai/sim/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13510.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13510"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-13510"},{"type":"ADVISORY","url":"https://vuldb.com/submit/838842"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/374518"},{"type":"REPORT","url":"https://github.com/simstudioai/sim/issues/4759"},{"type":"REPORT","url":"https://vuldb.com/vuln/374518/cti"},{"type":"FIX","url":"https://github.com/simstudioai/sim/pull/4760"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/simstudioai/sim","events":[{"introduced":"4f3bc37fe439c3bf8ea3b7dbfd0f3bf0ccf1df23"},{"last_affected":"fd194709675af1308013fcc849d7f00a7b1eac51"}],"database_specific":{"extracted_events":[{"introduced":"0.6.1"},{"last_affected":"0.6.1"},{"introduced":"0.6.2"},{"last_affected":"0.6.2"},{"introduced":"0.6.3"},{"last_affected":"0.6.3"},{"introduced":"0.6.4"},{"last_affected":"0.6.4"},{"introduced":"0.6.5"},{"last_affected":"0.6.5"},{"introduced":"0.6.6"},{"last_affected":"0.6.6"},{"introduced":"0.6.7"},{"last_affected":"0.6.7"},{"introduced":"0.6.8"},{"last_affected":"0.6.8"},{"introduced":"0.6.9"},{"last_affected":"0.6.9"},{"introduced":"0.6.10"},{"last_affected":"0.6.10"},{"introduced":"0.6.11"},{"last_affected":"0.6.11"},{"introduced":"0.6.12"},{"last_affected":"0.6.12"},{"introduced":"0.6.13"},{"last_affected":"0.6.13"},{"introduced":"0.6.14"},{"last_affected":"0.6.14"},{"introduced":"0.6.15"},{"last_affected":"0.6.15"},{"introduced":"0.6.16"},{"last_affected":"0.6.16"},{"introduced":"0.6.17"},{"last_affected":"0.6.17"},{"introduced":"0.6.18"},{"last_affected":"0.6.18"},{"introduced":"0.6.19"},{"last_affected":"0.6.19"},{"introduced":"0.6.20"},{"last_affected":"0.6.20"},{"introduced":"0.6.21"},{"last_affected":"0.6.21"},{"introduced":"0.6.22"},{"last_affected":"0.6.22"},{"introduced":"0.6.23"},{"last_affected":"0.6.23"},{"introduced":"0.6.24"},{"last_affected":"0.6.24"},{"introduced":"0.6.25"},{"last_affected":"0.6.25"},{"introduced":"0.6.26"},{"last_affected":"0.6.26"},{"introduced":"0.6.27"},{"last_affected":"0.6.27"},{"introduced":"0.6.28"},{"last_affected":"0.6.28"},{"introduced":"0.6.29"},{"last_affected":"0.6.29"},{"introduced":"0.6.30"},{"last_affected":"0.6.30"},{"introduced":"0.6.31"},{"last_affected":"0.6.31"},{"introduced":"0.6.32"},{"last_affected":"0.6.32"},{"introduced":"0.6.33"},{"last_affected":"0.6.33"},{"introduced":"0.6.34"},{"last_affected":"0.6.34"},{"introduced":"0.6.35"},{"last_affected":"0.6.35"},{"introduced":"0.6.36"},{"last_affected":"0.6.36"},{"introduced":"0.6.37"},{"last_affected":"0.6.37"},{"introduced":"0.6.38"},{"last_affected":"0.6.38"},{"introduced":"0.6.39"},{"last_affected":"0.6.39"},{"introduced":"0.6.40"},{"last_affected":"0.6.40"},{"introduced":"0.6.41"},{"last_affected":"0.6.41"},{"introduced":"0.6.42"},{"last_affected":"0.6.42"},{"introduced":"0.6.43"},{"last_affected":"0.6.43"},{"introduced":"0.6.44"},{"last_affected":"0.6.44"},{"introduced":"0.6.45"},{"last_affected":"0.6.45"},{"introduced":"0.6.46"},{"last_affected":"0.6.46"},{"introduced":"0.6.47"},{"last_affected":"0.6.47"},{"introduced":"0.6.48"},{"last_affected":"0.6.48"},{"introduced":"0.6.49"},{"last_affected":"0.6.49"},{"introduced":"0.6.50"},{"last_affected":"0.6.50"},{"introduced":"0.6.51"},{"last_affected":"0.6.51"},{"introduced":"0.6.52"},{"last_affected":"0.6.52"},{"introduced":"0.6.53"},{"last_affected":"0.6.53"},{"introduced":"0.6.54"},{"last_affected":"0.6.54"},{"introduced":"0.6.55"},{"last_affected":"0.6.55"},{"introduced":"0.6.56"},{"last_affected":"0.6.56"},{"introduced":"0.6.58"},{"last_affected":"0.6.58"},{"introduced":"0.6.59"},{"last_affected":"0.6.59"},{"introduced":"0.6.60"},{"last_affected":"0.6.60"},{"introduced":"0.6.61"},{"last_affected":"0.6.61"},{"introduced":"0.6.62"},{"last_affected":"0.6.62"},{"introduced":"0.6.63"},{"last_affected":"0.6.63"},{"introduced":"0.6.64"},{"last_affected":"0.6.64"},{"introduced":"0.6.65"},{"last_affected":"0.6.65"},{"introduced":"0.6.66"},{"last_affected":"0.6.66"},{"introduced":"0.6.67"},{"last_affected":"0.6.67"},{"introduced":"0.6.68"},{"last_affected":"0.6.68"},{"introduced":"0.6.69"},{"last_affected":"0.6.69"},{"introduced":"0.6.71"},{"last_affected":"0.6.71"},{"introduced":"0.6.72"},{"last_affected":"0.6.72"},{"introduced":"0.6.73"},{"last_affected":"0.6.73"},{"introduced":"0.6.75"},{"last_affected":"0.6.75"},{"introduced":"0.6.76"},{"last_affected":"0.6.76"},{"introduced":"0.6.77"},{"last_affected":"0.6.77"},{"introduced":"0.6.78"},{"last_affected":"0.6.78"},{"introduced":"0.6.79"},{"last_affected":"0.6.79"},{"introduced":"0.6.80"},{"last_affected":"0.6.80"},{"introduced":"0.6.81"},{"last_affected":"0.6.81"},{"introduced":"0.6.82"},{"last_affected":"0.6.82"},{"introduced":"0.6.83"},{"last_affected":"0.6.83"},{"introduced":"0.6.84"},{"last_affected":"0.6.84"},{"introduced":"0.6.85"},{"last_affected":"0.6.85"},{"introduced":"0.6.86"},{"last_affected":"0.6.86"},{"introduced":"0.6.87"},{"last_affected":"0.6.87"},{"introduced":"0.6.88"},{"last_affected":"0.6.88"},{"introduced":"0.6.89"},{"last_affected":"0.6.89"},{"introduced":"0.6.90"},{"last_affected":"0.6.90"},{"introduced":"0.6.91"},{"last_affected":"0.6.91"},{"introduced":"0.6.92"},{"last_affected":"0.6.92"}],"source":"AFFECTED_FIELD"}}],"versions":["0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.17","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.24","0.6.25","0.6.26","0.6.27","0.6.28","0.6.29","0.6.3","0.6.30","0.6.31","0.6.32","0.6.33","0.6.34","0.6.35","0.6.36","0.6.37","0.6.38","0.6.39","0.6.4","0.6.40","0.6.41","0.6.42","0.6.43","0.6.44","0.6.45","0.6.46","0.6.47","0.6.48","0.6.49","0.6.5","0.6.50","0.6.51","0.6.52","0.6.53","0.6.54","0.6.55","0.6.56","0.6.58","0.6.59","0.6.6","0.6.60","0.6.61","0.6.62","0.6.63","0.6.64","0.6.65","0.6.66","0.6.67","0.6.68","0.6.69","0.6.7","0.6.71","0.6.72","0.6.73","0.6.75","0.6.76","0.6.77","0.6.78","0.6.79","0.6.8","0.6.80","0.6.81","0.6.82","0.6.83","0.6.84","0.6.85","0.6.86","0.6.87","0.6.88","0.6.89","0.6.9","0.6.90","0.6.91","0.6.92","v0.6.92","v0.6.91","v0.6.90","v0.6.89","v0.6.88","v0.6.87","v0.6.86","v0.6.85","v0.6.84","v0.6.83","v0.6.82","v0.6.81","v0.6.80","v0.6.79","v0.6.78","v0.6.76","v0.6.77","v0.6.75","v0.6.73","v0.6.72","v0.6.71","v0.6.69","v0.6.68","v0.6.67","v0.6.66","v0.6.65","v0.6.64","v0.6.63","v0.6.62","v0.6.61","v0.6.60","v0.6.59","v0.6.58","v0.6.56","v0.6.55","v0.6.54","v0.6.53","v0.6.52","v0.6.51","v0.6.50","v0.6.49","v0.6.48","v0.6.47","v0.6.46","v0.6.45","v0.6.44","v0.6.43","v0.6.42","v0.6.41","v0.6.40","v0.6.39","v0.6.38","v0.6.37","v0.6.36","v0.6.35","v0.6.34","v0.6.33","v0.6.32","v0.6.31","v0.6.30","v0.6.29","v0.6.28","v0.6.27","v0.6.26","v0.6.25","v0.6.24","v0.6.23","v0.6.22","v0.6.21","v0.6.20","v0.6.19","v0.6.18","v0.6.17","v0.6.16","v0.6.15","v0.6.14","v0.6.13","v0.6.12","v0.6.11","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13510.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}]}