SimpleHelp OIDC Flaw Enables Auth Bypass
A SimpleHelp authentication bypass flaw lets unauthenticated attackers forge OIDC tokens to create Technician accounts and take over managed endpoints.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-48558 as exploited in the wild.
CVE-2026-48558 is an authentication bypass vulnerability in SimpleHelp, a self-hosted remote support and access tool widely used by IT teams and MSPs. The flaw affects deployments configured with OpenID Connect (OIDC) authentication, allowing remote, unauthenticated attackers to submit forged tokens containing arbitrary claims. This enables creation of new 'Technician' accounts, bypassing multi-factor authentication and granting full access to managed endpoints.
Exploitation requires specific but commonly encountered conditions: OIDC must be enabled, a TechnicianGroup must be associated with the OIDC provider, and the 'Allow group authenticated logins' setting must be active on that group—a configuration MS-ISAC notes is typically present in real-world deployments. Successful abuse would let attackers remotely control managed endpoints, execute scripts, install software, and view, modify, or delete data.
Given SimpleHelp's use by MSPs managing multiple downstream clients, exploitation could enable lateral compromise across customer environments, similar to prior supply-chain-style abuse of remote management tools. No in-the-wild exploitation has been reported at this time. Affected versions are SimpleHelp prior to v5.5.16 (stable) and pre-release v6.0 RC 2; organizations should patch promptly and review OIDC/TechnicianGroup configurations.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-simplehelp-could-allow-for-authentication-bypass_2026-061
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs