CVE-2026-48558: SimpleHelp OIDC authentication bypass via unverified token signature

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 score of 9.5, unauthenticated remote authentication bypass to a privileged technician session, CISA KEV listing with a near-term due date, and EPSS above the 99th percentile.

What it is

SimpleHelp 5.5.15 and earlier and 6.0 pre-release versions accept OIDC identity tokens without verifying their cryptographic signature. When OIDC is configured, a remote unauthenticated attacker can forge a token with arbitrary identity claims and obtain a fully authenticated technician session. The flaw is rated CVSS 4.0 9.5 critical and is listed in CISA KEV.

Impact

An attacker gains a fully authenticated technician session, which in a remote support product typically carries broad control over managed endpoints. In some configurations this also bypasses multi-factor authentication.

Attack surface

Reachable over the network through the OIDC login flow; no authentication and no user interaction are required. It only applies where OIDC authentication is configured, matching the AT:P attack requirement in the CVSS vector.

Exploitation

Listed in CISA KEV with a 2026-07-02 remediation due date, and EPSS 30-day probability is 0.64313 (99.19th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented in the record.

What to do

• Upgrade SimpleHelp to a fixed release per the vendor security update and release notes; 5.5.15 and prior and 6.0 pre-release builds are affected.
• If patching cannot be done immediately, disable OIDC authentication or restrict access to the SimpleHelp instance until the fix is applied.
• Follow CISA BOD 26-04 guidance, including evaluating internet exposure of each SimpleHelp asset and discontinuing use if mitigations are unavailable.
• Review technician accounts and sessions created since exposure for unauthorized access and rotate credentials and OIDC client secrets.
• Apply the vendor's forensics triage requirements referenced in the KEV entry.

Detection

• Hunt authentication logs for technician sessions established through the OIDC flow with anomalous or unexpected identity claims.
• Review SimpleHelp access logs for logins from unfamiliar source IPs or at unusual times, especially where MFA was expected.
• Check for new or modified technician accounts and for configuration changes made after suspicious OIDC logins.
• Use the IOCs published in the Horizon3 disclosure to scan for known exploitation artifacts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.