June 2026 CVE Landscape
60
CVE-2026-48558
KEVmoderateAuthentication Bypass via Forged OIDC Tokens in SimpleHelp
CISA: SimpleHelp Authentication Bypass Vulnerability
CVSS 4.0
9.5 critical
EPSS
64%p99
Published
()
KEV added
AI analysis
CVE-2026-48558 is an authentication bypass (CWE-347, improper verification of cryptographic signature) in the SimpleHelp remote access/support platform's OpenID Connect (OIDC) login flow, where submitted identity tokens are accepted without verifying their signature. It is triggered when OIDC authentication is configured: a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims and obtain a fully authenticated technician session, and in some configurations this also bypasses multi-factor authentication. Related reporting describes a path from this bypass to remote code execution. Only SimpleHelp deployments using OIDC-based (e.g., SSO) authentication are affected; deployments relying on local SimpleHelp accounts are not described as affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-29, confirming exploitation in the wild, with a 30% EPSS probability of exploitation within 30 days and no public proof-of-concept known.
What to do: Update SimpleHelp to the latest release per vendor instructions, prioritizing any internet-facing server (CISA KEV listing means federal agencies must act under BOD 26-04). Until patched, restrict access to the SimpleHelp web login to trusted management networks (VPN/firewall) or temporarily switch from OIDC to local-account authentication with MFA. Verify whether OIDC is enabled on each instance and review technician login logs for sessions created with unusual or unexpected identity claims.
Affected
| SimpleHelp | — |
Estimated exposure
moderateseveral thousand vulnerable servers (subset of roughly 10,000 internet-exposed SimpleHelp instances, limited to those with OIDC configured) — Public internet scans of SimpleHelp remote-access servers have historically found on the order of 10,000 exposed instances, but the flaw applies only to the subset of those deployments that have OIDC/SSO authentication enabled.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
CISA Known Exploited Vulnerability
- Affected
- SimpleHelp SimpleHelp
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- simple-help
- Products
- simplehelp
- Weakness
- CWE-347
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news10 stories
60
60
60
60
60
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
60
SimpleHelp OpenID Connect Auth Bypass to RCE [CVE-2026-48558]
Metasploit adds a module chaining SimpleHelp OpenID Connect authentication bypass to remote code execution, tracked as CVE-2026-48558.
A commit to the Rapid7 Metasploit Framework (dee04cdb) adds an exploit module for CVE-2026-48558, an OpenID Connect authentication bypass in SimpleHelp that can be escalated to remote code execution. SimpleHelp is widely deployed remote access and remote support software, making the auth bypass a serious exposure for exposed deployments. The commit provides public exploit code but the listing does not state observed exploitation.
48
35