CVE-2026-48558

SimpleHelp Authentication Bypass

10.0 CRITICALActively exploited (CISA KEV)EPSS 5.72%

Published12 Jun 2026
Added to CISA KEV29 Jun 2026
Remediation due2 Jul 2026

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

Added to KEV: 29 Jun 2026Federal remediation due: 2 Jul 2026

Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Simple-help Simplehelp< 5.5.16 · 6.0

Remediation

Fixed in

Simple-help Simplehelp≥ 5.5.16

Patch & vendor advisories

https://simple-help.com/security/simplehelp-security-update-2026-05

References

https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/Technical DescriptionThird Party Advisory
https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/Third Party Advisory
https://simple-help.com/release-newsRelease Notes
https://simple-help.com/security/simplehelp-security-update-2026-05PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-48558 being actively exploited?

Yes. CVE-2026-48558 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 29 Jun 2026.

How severe is CVE-2026-48558?

CVE-2026-48558 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 5.72% probability of exploitation.

Which products are affected by CVE-2026-48558?

Affected products include Simple-help Simplehelp.

How do I fix CVE-2026-48558?

Upgrade affected software to a fixed version, for example Simple-help Simplehelp 5.5.16 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-48558 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.