CVE-2026-48558

Published Jun 12, 2026

Last updated a month ago

Exploit known CVSS critical 9.5

npm

Network

Container Security

ICS

Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-48558 is an authentication bypass vulnerability found in SimpleHelp, a remote support and remote monitoring and management (RMM) platform. The flaw specifically affects the OpenID Connect (OIDC) authentication flow in SimpleHelp versions 5.5.15 and prior, as well as 6.0 pre-release builds. The vulnerability stems from SimpleHelp's improper verification of cryptographic signatures on OIDC identity tokens during the login process. This oversight allows an unauthenticated attacker to forge an OIDC identity token containing arbitrary identity claims. By submitting this crafted token, the attacker can obtain a fully authenticated technician session, potentially bypassing multi-factor authentication in some configurations. Real-world exploitation of CVE-2026-48558 has been observed, with attackers leveraging it to deploy infostealer payloads, including the previously undocumented Djinn Stealer and TaskWeaver malware.

Description: SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Source: disclosure@vulncheck.com
NVD status: Analyzed
Products: simplehelp

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.5
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: SimpleHelp Authentication Bypass Vulnerability
Exploit added on: Jun 29, 2026
Exploit action due: Jul 2, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

disclosure@vulncheck.com: CWE-347

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "60E78059-D944-49AD-B48D-0CFA8BE13598",
            "versionEndExcluding": "5.5.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:simple-help:simplehelp:6.0:pre-release:*:*:*:*:*:*",
            "matchCriteriaId": "4647570F-9368-4088-9E52-F63091C74B68",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.