Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-48558 10.0
SimpleHelp · SimpleHelp · Added 2026-06-29 · Published 2026-06-12
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySimpleHelp Authentication Bypass Vulnerability
VendorSimpleHelp
ProductSimpleHelp
Date added2026-06-29
Due date2026-07-02
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-347
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Descriptions

KEV: SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

NVD: SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-26 01:42 UTC
Wall time2.8s
Searches1
Component defaultno
Sources https://nvd.nist.gov/vuln/detail/CVE-2026-48558
https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html
https://threat-modeling.com/cve-2026-48558-simplehelp-rmm-authentication-bypass-cisa-kev/
https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/
https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558
https://www.josephcharnin.com/cybersecurity/simplehelp-auth-bypass-cve-2026-48558/
https://cvefeed.io/vuln/detail/CVE-2026-48558

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)
warn component_extraction: Component 'SimpleHelp OIDC token verification handler at POST /auth/oidc/callback' matches or contains product name 'SimpleHelp' — no specific component identified

Hunting hypothesis agent

Hunt SimpleHelp logs for POST to /auth/oidc/callback with JWT alg:none or 'none' signature; alert on new Technician accounts via OIDC from unexpected domains and sessions from unknown source IPs in server.log.

Research details

ComponentSimpleHelp OIDC token verification handler at POST /auth/oidc/callback
PreconditionsNetwork reachability to internet-facing SimpleHelp server (versions 5.5.15 and prior or 6.0 pre-release); OIDC authentication must be configured and a TechnicianGroup with 'Allow group authenticated logins' enabled (not default); no authentication required; OIDC token signature verification disabled. agent
Deliveryforged OIDC JWT token submitted via HTTP POST to /auth/oidc/callback endpoint with arbitrary claims including TechnicianGroup membership
Public PoCyes
PoC URLs https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558 Third-party repos; verify before use.
Advisoryhttps://simple-help.com/security-advisories
Exploit notesCVSS 10.0 CRITICAL | No auth required | Active exploitation deploying TaskWeaver loader and Djinn Stealer | Public PoC forges JWT with alg:none, submits to OIDC callback endpoint, obtains Technician session | Horizon3.ai published IOCs | CISA KEV added June 29, 2026 | Due: July 2
SummarySimpleHelp OIDC authentication bypass (CWE-347) allows unauthenticated remote attackers to forge identity tokens by exploiting missing JWT signature verification. The OIDC callback endpoint accepts tokens with alg:none or invalid signatures, granting fully privileged Technician sessions. Actively exploited in the wild to deploy TaskWeaver backdoor and Djinn Stealer malware.

Tia coverage

First reported2026-06-16
First exploit report2026-06-30
Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

simplehelp-cve-2026-48558-critical-flaw-allows-unauthenticated-t

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub