CVE-2026-3432 is a critical (CVSS 9.1) missing authorization flaw in Sim Studio before version 0.5.74. An unauthenticated caller can retrieve a user's OAuth access tokens for third-party services. Upgrade to 0.5.74 or later and revoke tokens that may have been exposed.
What's affected
Tenable's advisory (TRA-2026-13) lists SimStudio below 0.5.74 and rates it critical. The record says the /api/auth/oauth/token endpoint has a code path that skips all authorization checks when given a credential owner's user ID and a provider name.
The impact is theft of OAuth access tokens for services the user connected. The record names no more detail on versions beyond the 0.5.74 boundary.
How to check if you're exposed
Check the version of your Sim Studio deployment and compare it with 0.5.74. If you run it from a container image, read the tag.
Then review logs for requests to /api/auth/oauth/token that came without a session, especially in bulk. Also review the connected third-party services for logins or API activity you cannot explain.
What to do now
- Upgrade Sim Studio to 0.5.74 or later.
- Revoke and reissue the OAuth connections your users linked, if the endpoint was reachable from outside.
- Review third-party service audit logs for odd activity.
- Limit public access to the deployment to the paths that need it.
Why it matters
The weakness is CWE-862, missing authorization. The endpoint hands over tokens based on identifiers the caller supplies, without checking that the caller owns them. User IDs are not secrets, so knowing one should never be enough.
Stolen OAuth tokens reach beyond the application itself, into email, code hosting or cloud tools users connected. The record does not mark this CVE as exploited and it is not on the CISA KEV list.
Quick check
Do I need to rotate tokens after upgrading?
If the endpoint was reachable and you cannot rule out misuse, yes. Upgrading closes the hole but does not recall tokens already obtained.
Sources
Last reviewed: 19 October 2026.
