CVE-2025-15099
- Source
- https://cve.org/CVERecord?id=CVE-2025-15099
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15099.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-15099
- Published
- 2025-12-26T04:02:07Z
- Modified
- 2026-10-28T02:30:37Z
- Severity
-
- 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- simstudioai sim CRON Secret internal.ts improper authentication
- Details
-
A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is e359dc2946b12ed5e45a0ec9c95ecf91bd18502a. Applying a patch is the recommended action to fix this issue.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-287" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15099.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "0.5.0" }, { "last_affected": "0.5.0" }, { "introduced": "0.5.3" }, { "last_affected": "0.5.3" }, { "introduced": "0.5.4" }, { "last_affected": "0.5.4" }, { "introduced": "0.5.10" }, { "last_affected": "0.5.10" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" } ] } ] }- References
-
- https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15099.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-15099
- https://vuldb.com/?id.338430
- https://vuldb.com/?submit.710255
- https://github.com/simstudioai/sim/pull/2343
- https://vuldb.com/?ctiid.338430
- https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502a
- https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduce
Affected packages
Git / github.com/simstudioai/sim
Affected ranges
- Type
- GIT
- Repo
- https://github.com/simstudioai/sim
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.5.1" }, { "last_affected": "0.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.2" }, { "last_affected": "0.5.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.5" }, { "last_affected": "0.5.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.6" }, { "last_affected": "0.5.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.7" }, { "last_affected": "0.5.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.8" }, { "last_affected": "0.5.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.9" }, { "last_affected": "0.5.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.11" }, { "last_affected": "0.5.11" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.12" }, { "last_affected": "0.5.12" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.13" }, { "last_affected": "0.5.13" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.14" }, { "last_affected": "0.5.14" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.15" }, { "last_affected": "0.5.15" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.16" }, { "last_affected": "0.5.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.17" }, { "last_affected": "0.5.17" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.18" }, { "last_affected": "0.5.18" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.19" }, { "last_affected": "0.5.19" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.20" }, { "last_affected": "0.5.20" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.21" }, { "last_affected": "0.5.21" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.22" }, { "last_affected": "0.5.22" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.23" }, { "last_affected": "0.5.23" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.24" }, { "last_affected": "0.5.24" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.25" }, { "last_affected": "0.5.25" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.26" }, { "last_affected": "0.5.26" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5.27" }, { "last_affected": "0.5.27" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "e359dc2946b12ed5e45a0ec9c95ecf91bd18502a" } ], "source": "REFERENCES_COMMIT" } ] }