CVE-2026-48558: SimpleHelp — OIDC Authentication Bypass via Unsigned Token Acceptance

Background

SimpleHelp is a commercial remote monitoring and management (RMM) platform used by managed service providers and IT departments to remotely access and control endpoints. Its technician portal allows remote desktop, file transfer, script execution, and full administrative control over every managed device. This makes it a high-value target: compromise a SimpleHelp server and you gain privileged access to every endpoint it manages, typically across many client organisations simultaneously.

CVE-2026-48558 is a critical authentication bypass in SimpleHelp’s OpenID Connect (OIDC) authentication flow, assigned a CVSS score of 10.0. When OIDC is configured as an authentication method, the server accepts identity tokens without verifying their cryptographic signature. A remote, unauthenticated attacker can construct a forged JWT with arbitrary claims, submit it to the login endpoint, and receive a fully authenticated technician session in return. In configurations where OIDC is wired to a TechnicianGroup, the attacker also bypasses any multi-factor authentication applied to that group.

CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog on 29 June 2026, with a remediation due date of 2 July 2026, signalling confirmed active exploitation.

Technical Mechanism

The root cause is a failure to validate the cryptographic signature of identity tokens submitted during OIDC login. CWE-347 (Improper Verification of Cryptographic Signature) describes exactly this class of flaw.

In a correctly implemented OIDC flow, an identity provider (IdP) issues a signed JWT (JSON Web Token) asserting the user’s identity and group memberships. The relying party — in this case SimpleHelp — must validate the signature against the IdP’s published public key before trusting any of the claims in the token. If the signature check is absent or bypassable, an attacker who understands the expected JWT structure can craft a token with arbitrary sub, email, groups, or other claims and submit it directly.

Exploitation prerequisites:

1. OIDC authentication is enabled on the SimpleHelp server
2. At least one TechnicianGroup is associated with the OIDC provider
3. “Allow group authenticated logins” is enabled on that TechnicianGroup

A forged JWT payload targeting a TechnicianGroup looks like:

{
  "sub": "attacker-controlled-subject",
  "email": "attacker@example.com",
  "groups": ["TechnicianGroup"],
  "iat": 1751000000,
  "exp": 1751086400,
  "iss": "https://legitimate-idp.example.com"
}

The token is signed with an attacker-generated key (or left with an invalid/none algorithm). SimpleHelp’s authentication logic accepts the token without verifying the signature against the real IdP’s public key, creates a session as a technician in the target group, and returns a valid session cookie.

POST /login HTTP/1.1
Host: simplehelp-server.target.com
Content-Type: application/json

{
  "authMethod": "oidc",
  "idToken": "<attacker-forged-jwt-here>"
}

HTTP/1.1 200 OK
Set-Cookie: session=<valid-technician-session>; Path=/; HttpOnly

The MFA bypass follows from the same flaw: if MFA is enforced at the TechnicianGroup level via the OIDC flow, but the OIDC token is accepted without signature verification, MFA is never challenged. The forged token’s claims are accepted as the complete authentication assertion.

No client-side exploitation is required. The attack is a direct HTTP request to the SimpleHelp server’s login endpoint. No user interaction on managed endpoints is needed.

Real-World Exploitation Evidence

A public demonstration video showing the exploit was published shortly after disclosure, substantially lowering the skill barrier for exploitation. Horizon3.ai’s attack research team published technical IOC details on 16 June 2026, confirming they had reproduced the vulnerability and identifying observable indicators.

Internet scanning at the time of disclosure found approximately 14,000 SimpleHelp servers exposed on the public internet. Horizon3.ai estimated that roughly 7.2% of these — approximately 1,000 servers — were configured with the OIDC authentication method that makes them directly exploitable.

CISA’s addition to the KEV catalog on 29 June 2026 confirms that exploitation has moved beyond proof-of-concept into active attack campaigns. No specific threat actor group has been publicly attributed at time of writing, but RMM platforms have historically been targeted by ransomware operators (including operators who previously exploited Kaseya VSA and ConnectWise ScreenConnect) for exactly this reason: a single RMM compromise provides lateral access across all managed client environments simultaneously.

SimpleHelp specifically has prior CVE history relevant here. Earlier in 2025, researchers disclosed a chain of three vulnerabilities in SimpleHelp (CVE-2024-57727, CVE-2024-57728, CVE-2024-57726) that were exploited by threat actors linked to the Akira ransomware group within weeks of disclosure. The same pattern — disclosure, rapid exploit development, ransomware operator exploitation — is the expected trajectory for CVE-2026-48558.

Impact Assessment

• Full RMM platform compromise — an attacker with a forged technician session gains remote desktop, file transfer, and script execution access to every managed endpoint on the platform
• Cross-client blast radius — managed service providers running SimpleHelp host multiple client organisations; compromise of a single MSP server exposes all client environments simultaneously
• MFA bypass — multi-factor authentication configured at the TechnicianGroup level is fully bypassed since the OIDC token is never signature-verified
• No user interaction required — the attack is a single HTTP request to the server; no phishing or client-side exploitation is needed
• Ransomware delivery vector — persistent access via a legitimate RMM agent is a common ransomware pre-positioning technique; exploitation at scale is consistent with mass ransomware deployment TTPs

Affected Versions

Administrators running 5.5.14 or earlier should apply the 5.5.16 patch rather than upgrading to 6.0 unless they intended to be on the pre-release track.

Remediation Steps

1. Apply the vendor patch immediately — update to SimpleHelp 5.5.16 (stable) or SimpleHelp 6.0 RC2 (pre-release). SimpleHelp supports in-place upgrades from the administration console.

   Vendor advisory: https://simple-help.com/security/simplehelp-security-update-2026-05

   Confirm the installed version after upgrade in the SimpleHelp admin interface under Help > About SimpleHelp.

2. Temporary mitigation if patching cannot be immediate — disable OIDC authentication in the SimpleHelp server configuration:

   Admin Console > Authentication > OpenID Connect
   Disable: "Allow OIDC Authentication"

   This removes the vulnerable code path entirely. Only viable for deployments not dependent on OIDC-based technician login.

3. Restrict technician login endpoint access — where possible, apply network-level access controls to the SimpleHelp technician portal:

   # Allow only known technician IP ranges to reach the SimpleHelp login endpoint
   # Block all other source IPs at the network perimeter or host-based firewall
   iptables -A INPUT -p tcp --dport 5800 -s <trusted-technician-range> -j ACCEPT
   iptables -A INPUT -p tcp --dport 5800 -j DROP

4. Post-patch access review — audit all active technician sessions. If exploitation is suspected, treat all active sessions as potentially attacker-controlled, revoke credentials, and rotate any secrets accessible from managed endpoints.

Detection Guidance

Log sources: The primary detection surface is the SimpleHelp server log (server.log in the SimpleHelp installation directory) and authentication event records in the admin console.

SIEM detection approach:

# Detect OIDC login events from unexpected IP addresses
# Cross-correlate SimpleHelp OIDC auth success events against known technician IP allowlist

index=simplehelp sourcetype=simplehelp_server auth_method=oidc action=login_success
| lookup technician_ips src_ip OUTPUT is_known_ip
| where is_known_ip="false"
| stats count by src_ip, technician_name, _time

# Detect rapid session establishment without prior authentication history
# Flag technician sessions where no prior login from same IP exists in 30-day window

index=simplehelp action=session_start
| join technician_name [search index=simplehelp action=login_success earliest=-30d]
| where isnull(prior_login_ip)
| table _time, src_ip, technician_name, managed_endpoint

Suricata signature:

alert http any any -> $SIMPLEHELP_SERVERS any (msg:"CVE-2026-48558 SimpleHelp OIDC Auth Bypass - Forged JWT Submission"; flow:to_server,established; content:"POST"; http_method; content:"/login"; http_uri; content:"oidc"; http_client_body; content:"idToken"; http_client_body; sid:2026485581; rev:1;)

Behavioural indicators:

• Remote sessions to endpoints initiated without a corresponding helpdesk ticket or change request
• Script execution or software installation activity on managed endpoints not associated with an authorised change
• New technician accounts created unexpectedly or account role changes without corresponding change management records
• Network connections from managed endpoints to infrastructure not on your normal communication baseline

Horizon3.ai IOCs: Technical indicators specific to this CVE were published at https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ on 16 June 2026.

Timeline

References

• SimpleHelp Security Advisory — CVE-2026-48558
• Horizon3.ai Technical Analysis — CVE-2026-48558
• Horizon3.ai IOC Disclosure — CVE-2026-48558
• Help Net Security — SimpleHelp RMM CVE-2026-48558 Coverage
• CISA Known Exploited Vulnerabilities Catalog
• NVD — CVE-2026-48558