{"id":"CVE-2026-48558","kind":"vulnerability","aliases":["CVE-2026-48558"],"related":[],"title":"simple-help simplehelp: SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in…","description":"SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"SimpleHelp, a remote support tool, accepts OIDC identity tokens at login without verifying their signature when OIDC is configured. An unauthenticated remote attacker can forge a token with arbitrary identity claims and get a fully authenticated technician session, and in some configurations bypass MFA.","severity":"critical","cvss":10.0,"epss":null,"exploited":true,"exploited_at":"2026-06-29T00:00:00+00:00","products":[{"name":"SimpleHelp SimpleHelp","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"simple-help simplehelp","fixed":["5.5.16"],"affected":"< 5.5.16","ecosystem":"vendor"},{"name":"simple-help simplehelp","fixed":[],"affected":"= 6.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","oidc","remote-support","self-hosted","simplehelp","vendor"],"not_affected_if":["no-internet-exposure","oidc-not-configured"],"how_to_check":"Check whether OIDC authentication is enabled in the SimpleHelp server configuration; unknown for the exact setting name.\nReview the SimpleHelp version in use against the vendor advisory; unknown for affected version ranges.\nReview SimpleHelp access logs for unexpected technician logins; unknown for log path.","fix":"Apply the vendor patch or mitigation per the SimpleHelp advisory; fixed version unknown from sources.\nIf no mitigation exists, disable OIDC authentication or take the server off the internet, per CISA guidance to discontinue use if mitigations are unavailable.","status":"open","published_at":"2026-06-12T18:16:35+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:48+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.75,"triage":{"at":"2026-10-23T20:33:48Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor patch or mitigation per the SimpleHelp advisory; fixed version unknown from sources.\nIf no mitigation exists, disable OIDC authentication or take the server off the internet, per CISA guidance to discontinue use if mitigations are unavailable.","summary":"SimpleHelp, a remote support tool, accepts OIDC identity tokens at login without verifying their signature when OIDC is configured. An unauthenticated remote attacker can forge a token with arbitrary identity claims and get a fully authenticated technician session, and in some configurations bypass MFA.","category":"vendor","who_cares":["simplehelp","self-hosted","remote-support","oidc"],"confidence":0.75,"analyst_note":"Confirm affected and fixed SimpleHelp versions and the exact OIDC setting from the SimpleHelp vendor advisory (linked from the CISA KEV entry, CVE-2026-48558).","how_to_check":"Check whether OIDC authentication is enabled in the SimpleHelp server configuration; unknown for the exact setting name.\nReview the SimpleHelp version in use against the vendor advisory; unknown for affected version ranges.\nReview SimpleHelp access logs for unexpected technician logins; unknown for log path.","needs_analyst":true,"not_affected_if":["oidc-not-configured","no-internet-exposure"],"severity_if_unknown":"critical"},"cost_usd":0.000476,"input_tokens":2303,"output_tokens":491,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':173C,199C,230C '-2026':22A,25A '-48558':23A,26A '26':172C,198C,229C '5.5.15':7A '6.0':11A 'accept':52B,113C 'accord':162C 'action':158C 'adher':226C 'allow':149C 'also':148C 'appli':159C 'applic':196C 'arbitrari':75B,133C 'asset':220C 'attack':69B,126C 'authent':18A,82B,94C,100C,104C,140C,155C 'base':177C 'bod':171C,197C,228C 'bypass':19A,89B,95C,150C 'cisa':156C,169C,186C 'claim':77B,135C 'cloud':202C 'complianc':167C 'configur':65B,88B,106C,122C,145C 'contain':16A,92C,132C 'cryptograph':117C 'cve':21A,24A 'discontinu':205C 'ensur':166C,225C 'evalu':218C 'exploit':37B 'exposur':223C 'factor':154C 'flow':101C 'follow':195C 'forens':188C 'forg':71B,130C 'fulli':81B,139C 'get':79B 'guidanc':184C,200C 'guidelin':232C 'help':3A,31A,35A 'host':44B 'ident':54B,76B,107C,134C 'instruct':165C 'internet':222C 'login':57B,111C 'may':147C 'mfa':90B 'mitig':160C,211C 'multi':153C 'multi-factor':152C 'note':183C,194C 'obtain':137C 'oidc':38B,53B,63B,99C,103C 'patch':231C 'pre':13A 'pre-releas':12A 'prior':9A 'priorit':174C 'product':209C 'releas':14A 'remot':40B,49B,68B,124C 'remote-support':39B 'requir':157C,190C 'respons':216C 'risk':179C 'secur':175C 'see':180C,191C 'self':43B 'self-host':42B 'servic':203C 'session':84B,142C 'signatur':61B,118C 'simpl':2A 'simple':30A,34A 'simple-help':1A,29A,33A 'simplehelp':4A,5A,27A,28A,32A,36A,45B,47B,91C 'stakehold':214C 'submit':109C,128C 'support':41B,50B 'technician':83B,141C 'token':55B,73B,108C,131C 'tool':51B 'triag':189C 'unauthent':67B,125C 'unavail':213C 'updat':176C 'url':181C,192C 'use':206C 'vendor':46B,164C 'verifi':59B,115C 'version':6A,15A 'vulner':20A,96C,121C 'without':58B,114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-12T18:16:35+00:00","kev":{"dateAdded":"2026-06-29","dueDate":"2026-07-02","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-48558","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48558","severity":null,"published_at":"2026-06-29T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-48558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48558","severity":null,"published_at":"2026-06-12T18:16:35+00:00","modified_at":"2026-10-07T20:17:12+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}