Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-3432 is a critical-severity Missing Authorization (CWE-862) vulnerability in Sim Sim. Its CVSS base score is 9.3 (Critical).
Operationally, ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-3432 is a critical authorization bypass vulnerability (CWE-862) in SimStudio versions below 0.5.74, specifically within the `/api/auth/oauth/token` endpoint. This flaw enables a code path that skips all authorization checks when the `credentialAccountUserId` and `providerId` parameters are supplied, allowing unauthorized retrieval of sensitive OAuth data. The issue carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), highlighting its high severity due to network accessibility, low complexity, and lack of prerequisites.
Unauthenticated attackers can exploit this vulnerability remotely by providing any target user's ID along with a provider name via the affected endpoint. Successful exploitation grants the attacker the victim's OAuth access tokens, enabling credential theft and subsequent unauthorized access to linked third-party services.
The Tenable research advisory (TRA-2026-13) at https://www.tenable.com/security/research/tra-2026-13 details mitigation strategies, including upgrading to SimStudio version 0.5.74 or later to address the bypass.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9173
Vulnerability Data
On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user…
more
ID and a provider name, effectively stealing credentials to third-party services.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorization decisions on every access request, structurally eliminating missing authorization checks.
AC-24 mandates that access control decisions are applied to each request, preventing bypass of authorization logic.
AC-25 requires a tamperproof, always-invoked reference monitor that ensures authorization checks cannot be omitted.
AC-6 reduces the set of actions reachable without proper authorization, limiting blast radius of missing checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).
A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce authorization decisions, which squarely stops exploitation of missing authorization (CWE-862); the bounded remainder is non-access mechanisms such as path traversal or CSRF that are outside its scope per the AC-3/A01:2025 anchor.
Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.
By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.
Requiring evidence of minimum security capabilities and acceptance testing ensures that missing or bypassed authorization checks are detected before the delivered software is accepted.
Mandating read-only access or proxy execution by an authorized administrator ensures every requested operation is explicitly authorized before it occurs.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-862, a class-level weakness, and none of its children carries one either.