Sim Studio AI Vulnerabilities Expose User Credentials and MongoDB Instances

Sim Studio AI Vulnerabilities Expose User Credentials and MongoDB Instances

First seen 2 Mar 2026, 13:10 UTC •Tenable •24.3

Article Content

Browse articles
ThreatCluster

Two critical vulnerabilities have been identified in Sim Studio AI. The first allows unauthenticated attackers to retrieve OAuth access tokens for any user by exploiting the `/api/auth/oauth/token` endpoint. The second vulnerability involves MongoDB tool endpoints that permit unauthorized access to any reachable MongoDB instance, enabling attackers to read, modify, and delete data.

How this analysis works

Timeline

2026-03-02
Vulnerabilities disclosed in Tenable articles
2026-03-02
Recommendation to upgrade to SimStudio 0.5.74 or later

Extracted Entities

1 / 2