CVE-2026-48558

Summary

SimpleHelp Authentication Bypass Vulnerability

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

Published 2026-06-29 · first seen here 2026-10-10

CISA required action (due 2026-07-02): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Analysis & write-ups

No technical write-up from a research team yet. Contact Zero checks Unit 42, Google/Mandiant, Microsoft, Talos, CrowdStrike, Rapid7, watchTowr and others several times a day, plus NVD and CISA reference links.

Exploit availability

Public exploit code lowers the bar for attackers, so prioritise patching and hunting. These repositories are unverified. Fake PoCs that contain malware are common, so never run them outside an isolated lab.

• Nuclei detection template · ProjectDiscovery
• J4ck3LSyN-Gen2/CVE-2026-48558 · ★7 · created 2026-07-02

Where it shows in your logs

Server or web application · Authentication bypass or missing authorisation medium confidence

What to look for

• Admin or API actions with no successful login before them in the same session
• New admin accounts, API keys or tokens created shortly after unusual requests
• Requests to admin or API endpoints from internet IPs
• The application's process (w3wp.exe, java, tomcat, node, php-fpm, httpd, python) starting shells or LOLBins (cmd, powershell, sh, bash, curl, wget, certutil)
• New script files in web roots (.jsp, .aspx, .php): a web shell
• Requests to unusual URLs on the application from internet IPs right before any of the above
• Outbound connections from the server to new external IPs

Data sources

A generic baseline worked out from the product type and weakness (CWE-347), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.

News & advisories

• Metasploit Wrap Up: This One Goes to Sixteen! · Rapid7

References

• NVD entry
• CISA KEV
• https://simple-help.com/security/simplehelp-security-update-2026-05
• https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk