SimpleHelp OIDC Authentication Bypass
SimpleHelp 5.5.15 and prior accepts OIDC identity tokens without verifying their signature — a forged token yields a full technician session. CVSS 10.0, KEV, patch is 5.5.16.
- Vendor
- SimpleHelp
- Product
- SimpleHelp Server
- CVSS
- 10.0
- EPSS (exploit probability)
- 5.7%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-48558 being exploited?
Yes. CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 5.7% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Affected: SimpleHelp Server 5.5.15 and prior, and any 6.0 pre-release build. The bug is in the OIDC login flow — when OIDC is configured, the server accepts the identity token the client submits without ever verifying its cryptographic signature. A remote, unauthenticated attacker submits a forged token carrying arbitrary claims and lands in a fully authenticated technician session. In some deployments this also bypasses MFA, because MFA is bolted onto the local login path and the OIDC path skips it entirely. No user interaction required.
The technician role is the point. SimpleHelp Server is on-prem remote-support tooling — from a technician session an attacker can reach every endpoint enrolled with that server. That’s the entire reason CVSS scored this a 10.0 and CISA moved it into the Known Exploited Vulnerabilities catalog on 2026-06-29 with a 2026-07-02 federal patch deadline — that deadline has now passed.
What to do
- Upgrade to SimpleHelp 5.5.16 or later per the vendor security update. There is no supported mitigation short of the patch — the fix restores signature verification on the OIDC path.
- If you can’t upgrade immediately, disable OIDC on the SimpleHelp Server and restrict access to the management interface to a bastion/VPN allowlist. Local admin login is not affected by this specific bug.
- Assume compromise if the server has been reachable from the internet with OIDC configured. Horizon3.ai has published IoCs and Blackpoint Cyber has documented a related post-exploitation chain — check the server’s auth logs against those and inventory technician sessions created since the vendor advisory published 2026-05-27.
Sources
Other SimpleHelp CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-57728 SimpleHelp Path Traversal Vulnerabilityransomware use | [ HIGH ] | 7.2 | 64.7% | |
| CVE-2024-57726 SimpleHelp Missing Authorization Vulnerabilityransomware use | [ CRITICAL ] | 9.9 | 66.6% | |
| CVE-2024-57727 SimpleHelp Path Traversal Vulnerabilityransomware use | [ HIGH ] | 7.5 | 96.6% |
