Act nowKnown exploited

Advisory · CVE-2026-48558

Forged login tokens can take over SimpleHelp servers

SimpleHelp 5.5.15 and earlier accept OIDC identity tokens without verifying their signature, letting an unauthenticated attacker log in as any user.

Advisory published June 29, 2026Independent summary
Vendor
SimpleHelp
Product
SimpleHelp
Identifier / CWE
CVE-2026-48558
CWE-347
Action timing
Jul 20, 2026
ELI5

Explain it like I’m five

SimpleHelp's login desk accepts any ID badge without checking whether it is real. Print your own badge that says 'manager' and walk straight in.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01OIDC configured

    The target SimpleHelp server has OIDC authentication configured, which is when the flaw is reachable.

  2. 02Forged token

    A remote, unauthenticated attacker crafts an identity token containing arbitrary claims, including an administrator identity.

  3. 03Signature skipped

    SimpleHelp accepts the token without verifying its cryptographic signature.

  4. 04Full login

    The attacker is logged in with the forged identity, gaining control of remote access sessions.

What happened

CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog on June 29, 2026. The flaw affects SimpleHelp 5.5.15 and earlier and 6.0 pre-release versions.

When OIDC authentication is configured, SimpleHelp accepts identity tokens submitted during login without verifying their cryptographic signature. A remote, unauthenticated attacker can submit a forged token containing arbitrary claims and be logged in as the claimed identity, including an administrator. In other words, the signature check that is supposed to prove the token came from the trusted identity provider is simply missing. The vulnerability is scored CVSS 10.0, and independent researchers (Horizon3) have published attack research with indicators of compromise.

SimpleHelp published a security update in May 2026 with fixed releases: 5.5.16 for the 5.5.x line and 6.0 RC2 for the 6.0 line. The vendor notes that exploitability depends on server settings and network context, but urges updating to a secure release as soon as possible.

What to do

  1. Upgrade SimpleHelp servers to 5.5.16 (5.5.x line) or 6.0 RC2 (6.0 line) immediately.
  2. On any server that had OIDC configured while vulnerable, review authentication logs for anomalous administrator logins, unexpected sessions, and new technician accounts or devices.
  3. Rotate administrator credentials and review active remote sessions for anything not attributable to your support staff.
  4. Restrict network access to the SimpleHelp server to expected sources while remediation and investigation are underway.

Management note

Remote access tools are the keys to every machine your support team touches, so a total authentication bypass in one is a skeleton key to the estate. This flaw is only reachable when OIDC login is enabled, which makes scoping fast: if you know which SimpleHelp servers use OIDC, you know exactly where to look. Patch those first, then treat any unexplained admin session on them as a breach until proven otherwise.