---
id: CVE-2026-86115
title: >-
  Sim before 0.8.14 classifies tool requests as internal based on URL prefix
  matching without scheme normalization, skipping SSRF validation and minting
  internal authentication tokens
summary: >-
  Sim before 0.8.14 classifies tool requests as internal based on URL prefix
  matching without scheme normalization, skipping SSRF validation and minting
  internal authentication tokens. Authenticated workflow authors can bypass
  external URL…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'
cwe:
  - CWE-441
vendor: simstudioai
product: sim
affected:
  - sim < 0.8.14
published: '2026-09-05'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:46.913'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86115'
references:
  - url: 'https://github.com/geo-chen/oss/blob/main/sim.md'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/simstudioai/sim'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/lib/auth/hybrid.ts
    label: disclosure@vulncheck.com
  - url: 'https://github.com/simstudioai/sim/blob/v0.8.13/apps/sim/tools/index.ts'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/simstudioai/sim/pull/7179'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sim-before-0.8.14-confused-deputy-in-tool-url-routing-mints-an-internal-token-for-a-user-supplied-api-path
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.003
epssPercentile: 0.22948
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T18:09:00.618331Z'
ingestedAt: '2026-09-06T07:51:55.892Z'
---

## Overview

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated workflow authors can bypass external URL validation by supplying paths starting with /api/ in HTTP blocks to reach internal-only endpoints like POST /api/function/execute.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.