CVE-2026-3432

CVE-2026-3432 is a critical vulnerability affecting SimStudio versions below 0.5.74. It allows unauthenticated attackers to bypass authorization checks on the /api/auth/oauth/token endpoint by providing a user ID and provider name. This enables the theft of OAuth access tokens, granting access to users' third-party service credentials. Rated 9.1 CRITICAL on CVSS, this vulnerability has a low attack complexity and requires no user interaction, leading to high confidentiality and integrity impacts. An attacker can remotely exploit this to gain unauthorized access to sensitive information. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in CISA's KEV catalog. While community discussion is minimal, Tenable has issued an advisory, indicating awareness within the security community.