CVE-2026-3432

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-343207.5Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interfa CVE-2026-343214.8Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com CVE-2026-343236.3Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication). Supported ver CVE-2026-343246.5Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions th CVE-2026-343256.8Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (com CVE-2026-343278.2Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoof CVE-2026-343285.5Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information lo CVE-2026-343298.8Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-34334.3Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket eve CVE-2026-343307.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2026-343317.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized at CVE-2026-343328.0Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.