CVE-2026-48558

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

Published Jun 12, 2026 CVSS 4.0 · 9.5 Critical EPSS 80.3% KEV · Listed

Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

Analysis

Technical impact

SimpleHelp versions 5.5.15 and earlier, along with pre‑release 6.0 releases, allow an attacker to bypass authentication by supplying an OIDC identity token that the server accepts without checking its cryptographic signature. This flaw lets a remote, unauthenticated attacker forge arbitrary identity claims and obtain a fully authenticated technician session. In certain setups the bypass also defeats multi‑factor authentication. The weakness is a missing signature verification and is classified as CWE‑347.

Affected Systems

Any installation of SimpleHelp utilizing OIDC authentication on the vulnerable releases is at risk. The affected releases are 5.5.15 and earlier, and pre‑release 6.0 versions. Any product identified as SimpleHelp by SimpleHelp that uses this.

Risk and Exploitability

The CVSS score of 9.5 signals a high‑severity authentication bypass, and the EPSS score of 81% indicates a high exploitation probability. Attackers can exploit the flaw remotely, with no user interaction and no special privileges, making it accessible to a wide threat set. The vulnerability is listed in the CISA KEV catalog. An attacker can send a crafted JWT to the OIDC authentication endpoint, taking advantage of the missing signature validation to hijack a technician session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SimpleHelp

affected

Version	Status	Constraints
`5.5.0`	affected	< 5.5.16
`6.0`	affected	< 6.0 RC2

Configuration 1 [-]

OR	cpe:2.3:a:simple-help:simplehelp::::::::
	cpe:2.3:a:simple-help:simplehelp:6.0:pre-release::::::

No data.

Vendor Product Versions

Simple-help

Simplehelp

Version	Status	Scheme	Platform
`[5.5.0,5.5.16)`	affected	semver	—
`[6.0,6.0 RC2)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update SimpleHelp to the latest released version that includes OIDC signature, consider temporarily disabling OIDC authentication or enforcing strict JWT signature checks through middleware
Ensure that the OIDC provider’s configuration requires valid signatures and rejects unsigned tokens
Restrict inbound traffic to the OIDC authentication endpoint to trusted IP ranges, preventing unauthenticated external submissions.

Generated by OpenCVE AI on November 4, 2026 at 15:11 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since June 29, 2026.

Exploit prediction score: 80.3% (80.251% probability within 30 days)

Exploitation active

Automatable yes

Technical Impact total

References

Link	Providers
https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/
https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
https://simple-help.com/release-news
https://simple-help.com/security/simplehelp-security-update-2026-05
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558

History

Jul 14, 2026 9:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:simple-help:simplehelp::::::::

Jun 29, 2026 8:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 29, 2026 7:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2026-06-29T00:00:00+00:00', 'dueDate': '2026-07-02T00:00:00+00:00'}`

Jun 29, 2026 7:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/

Jun 12, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 12, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Simple-help Simple-help simplehelp
Vendors & Products		Simple-help Simple-help simplehelp

Jun 12, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 12, 2026 6:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Title		SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
Weaknesses		CWE-347
References		https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ https://simple-help.com/release-news https://simple-help.com/security/simplehelp-security-update-2026-05
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`