{ "affected": [ { "ranges": [ { "database_specific": { "extracted_events": [ { "introduced": "0.6.1" }, { "last_affected": "0.6.1" }, { "introduced": "0.6.2" }, { "last_affected": "0.6.2" }, { "introduced": "0.6.3" }, { "last_affected": "0.6.3" }, { "introduced": "0.6.4" }, { "last_affected": "0.6.4" }, { "introduced": "0.6.5" }, { "last_affected": "0.6.5" }, { "introduced": "0.6.6" }, { "last_affected": "0.6.6" }, { "introduced": "0.6.7" }, { "last_affected": "0.6.7" }, { "introduced": "0.6.8" }, { "last_affected": "0.6.8" }, { "introduced": "0.6.9" }, { "last_affected": "0.6.9" }, { "introduced": "0.6.10" }, { "last_affected": "0.6.10" }, { "introduced": "0.6.11" }, { "last_affected": "0.6.11" }, { "introduced": "0.6.12" }, { "last_affected": "0.6.12" }, { "introduced": "0.6.13" }, { "last_affected": "0.6.13" }, { "introduced": "0.6.14" }, { "last_affected": "0.6.14" }, { "introduced": "0.6.15" }, { "last_affected": "0.6.15" }, { "introduced": "0.6.16" }, { "last_affected": "0.6.16" }, { "introduced": "0.6.17" }, { "last_affected": "0.6.17" }, { "introduced": "0.6.18" }, { "last_affected": "0.6.18" }, { "introduced": "0.6.19" }, { "last_affected": "0.6.19" }, { "introduced": "0.6.20" }, { "last_affected": "0.6.20" }, { "introduced": "0.6.21" }, { "last_affected": "0.6.21" }, { "introduced": "0.6.22" }, { "last_affected": "0.6.22" }, { "introduced": "0.6.23" }, { "last_affected": "0.6.23" }, { "introduced": "0.6.24" }, { "last_affected": "0.6.24" }, { "introduced": "0.6.25" }, { "last_affected": "0.6.25" }, { "introduced": "0.6.26" }, { "last_affected": "0.6.26" }, { "introduced": "0.6.27" }, { "last_affected": "0.6.27" }, { "introduced": "0.6.28" }, { "last_affected": "0.6.28" }, { "introduced": "0.6.29" }, { "last_affected": "0.6.29" }, { "introduced": "0.6.30" }, { "last_affected": "0.6.30" }, { "introduced": "0.6.31" }, { "last_affected": "0.6.31" }, { "introduced": "0.6.32" }, { "last_affected": "0.6.32" }, { "introduced": "0.6.33" }, { "last_affected": "0.6.33" }, { "introduced": "0.6.34" }, { "last_affected": "0.6.34" }, { "introduced": "0.6.35" }, { "last_affected": "0.6.35" }, { "introduced": "0.6.36" }, { "last_affected": "0.6.36" }, { "introduced": "0.6.37" }, { "last_affected": "0.6.37" }, { "introduced": "0.6.38" }, { "last_affected": "0.6.38" }, { "introduced": "0.6.39" }, { "last_affected": "0.6.39" }, { "introduced": "0.6.40" }, { "last_affected": "0.6.40" }, { "introduced": "0.6.41" }, { "last_affected": "0.6.41" }, { "introduced": "0.6.42" }, { "last_affected": "0.6.42" }, { "introduced": "0.6.43" }, { "last_affected": "0.6.43" }, { "introduced": "0.6.44" }, { "last_affected": "0.6.44" }, { "introduced": "0.6.45" }, { "last_affected": "0.6.45" }, { "introduced": "0.6.46" }, { "last_affected": "0.6.46" }, { "introduced": "0.6.47" }, { "last_affected": "0.6.47" }, { "introduced": "0.6.48" }, { "last_affected": "0.6.48" }, { "introduced": "0.6.49" }, { "last_affected": "0.6.49" }, { "introduced": "0.6.50" }, { "last_affected": "0.6.50" }, { "introduced": "0.6.51" }, { "last_affected": "0.6.51" }, { "introduced": "0.6.52" }, { "last_affected": "0.6.52" }, { "introduced": "0.6.53" }, { "last_affected": "0.6.53" }, { "introduced": "0.6.54" }, { "last_affected": "0.6.54" }, { "introduced": "0.6.55" }, { "last_affected": "0.6.55" }, { "introduced": "0.6.56" }, { "last_affected": "0.6.56" }, { "introduced": "0.6.58" }, { "last_affected": "0.6.58" }, { "introduced": "0.6.59" }, { "last_affected": "0.6.59" }, { "introduced": "0.6.60" }, { "last_affected": "0.6.60" }, { "introduced": "0.6.61" }, { "last_affected": "0.6.61" }, { "introduced": "0.6.62" }, { "last_affected": "0.6.62" }, { "introduced": "0.6.63" }, { "last_affected": "0.6.63" }, { "introduced": "0.6.64" }, { "last_affected": "0.6.64" }, { "introduced": "0.6.65" }, { "last_affected": "0.6.65" }, { "introduced": "0.6.66" }, { "last_affected": "0.6.66" }, { "introduced": "0.6.67" }, { "last_affected": "0.6.67" }, { "introduced": "0.6.68" }, { "last_affected": "0.6.68" }, { "introduced": "0.6.69" }, { "last_affected": "0.6.69" }, { "introduced": "0.6.71" }, { "last_affected": "0.6.71" }, { "introduced": "0.6.72" }, { "last_affected": "0.6.72" }, { "introduced": "0.6.73" }, { "last_affected": "0.6.73" }, { "introduced": "0.6.75" }, { "last_affected": "0.6.75" }, { "introduced": "0.6.76" }, { "last_affected": "0.6.76" }, { "introduced": "0.6.77" }, { "last_affected": "0.6.77" }, { "introduced": "0.6.78" }, { "last_affected": "0.6.78" }, { "introduced": "0.6.79" }, { "last_affected": "0.6.79" }, { "introduced": "0.6.80" }, { "last_affected": "0.6.80" }, { "introduced": "0.6.81" }, { "last_affected": "0.6.81" }, { "introduced": "0.6.82" }, { "last_affected": "0.6.82" }, { "introduced": "0.6.83" }, { "last_affected": "0.6.83" }, { "introduced": "0.6.84" }, { "last_affected": "0.6.84" }, { "introduced": "0.6.85" }, { "last_affected": "0.6.85" }, { "introduced": "0.6.86" }, { "last_affected": "0.6.86" }, { "introduced": "0.6.87" }, { "last_affected": "0.6.87" }, { "introduced": "0.6.88" }, { "last_affected": "0.6.88" }, { "introduced": "0.6.89" }, { "last_affected": "0.6.89" }, { "introduced": "0.6.90" }, { "last_affected": "0.6.90" }, { "introduced": "0.6.91" }, { "last_affected": "0.6.91" }, { "introduced": "0.6.92" }, { "last_affected": "0.6.92" } ], "source": "AFFECTED_FIELD" }, "events": [ { "introduced": "4f3bc37fe439c3bf8ea3b7dbfd0f3bf0ccf1df23" }, { "last_affected": "fd194709675af1308013fcc849d7f00a7b1eac51" } ], "repo": "https://github.com/simstudioai/sim", "type": "GIT" } ], "versions": [ "0.6.1", "0.6.10", "0.6.11", "0.6.12", "0.6.13", "0.6.14", "0.6.15", "0.6.16", "0.6.17", "0.6.18", "0.6.19", "0.6.2", "0.6.20", "0.6.21", "0.6.22", "0.6.23", "0.6.24", "0.6.25", "0.6.26", "0.6.27", "0.6.28", "0.6.29", "0.6.3", "0.6.30", "0.6.31", "0.6.32", "0.6.33", "0.6.34", "0.6.35", "0.6.36", "0.6.37", "0.6.38", "0.6.39", "0.6.4", "0.6.40", "0.6.41", "0.6.42", "0.6.43", "0.6.44", "0.6.45", "0.6.46", "0.6.47", "0.6.48", "0.6.49", "0.6.5", "0.6.50", "0.6.51", "0.6.52", "0.6.53", "0.6.54", "0.6.55", "0.6.56", "0.6.58", "0.6.59", "0.6.6", "0.6.60", "0.6.61", "0.6.62", "0.6.63", "0.6.64", "0.6.65", "0.6.66", "0.6.67", "0.6.68", "0.6.69", "0.6.7", "0.6.71", "0.6.72", "0.6.73", "0.6.75", "0.6.76", "0.6.77", "0.6.78", "0.6.79", "0.6.8", "0.6.80", "0.6.81", "0.6.82", "0.6.83", "0.6.84", "0.6.85", "0.6.86", "0.6.87", "0.6.88", "0.6.89", "0.6.9", "0.6.90", "0.6.91", "0.6.92" ] } ], "database_specific": { "cna_assigner": "VulDB", "cwe_ids": [ "CWE-327", "CWE-328" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13510.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "0.6.0" }, { "last_affected": "0.6.0" }, { "introduced": "0.6.57" }, { "last_affected": "0.6.57" }, { "introduced": "0.6.70" }, { "last_affected": "0.6.70" }, { "introduced": "0.6.74" }, { "last_affected": "0.6.74" } ], "source": "AFFECTED_FIELD" } ] }, "details": "A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.", "id": "CVE-2026-13510", "modified": "2026-08-12T03:51:26.650972180Z", "published": "2026-06-28T22:15:11.256Z", "references": [ { "type": "WEB", "url": "https://github.com/simstudioai/sim/" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13510.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13510" }, { "type": "ADVISORY", "url": "https://vuldb.com/cve/CVE-2026-13510" }, { "type": "ADVISORY", "url": "https://vuldb.com/submit/838842" }, { "type": "ADVISORY", "url": "https://vuldb.com/vuln/374518" }, { "type": "REPORT", "url": "https://github.com/simstudioai/sim/issues/4759" }, { "type": "REPORT", "url": "https://vuldb.com/vuln/374518/cti" }, { "type": "FIX", "url": "https://github.com/simstudioai/sim/pull/4760" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "type": "CVSS_V4" } ], "summary": "SimStudioAI sim Password Protection deployment.ts weak hash" }