Which versions of SimpleHelp are affected by CVE-2026-48558?

SimpleHelp versions 5.5.15 and earlier contain a critical authentication bypass that allows remote unauthenticated attackers to forge identity tokens and obtain fully authenticated technician…. A patch is available.

Is there a public PoC exploit available for CVE-2026-48558?

Yes, a public proof-of-concept exploit is available for CVE-2026-48558. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-48558?

24 hours: Audit all SimpleHelp instances to identify versions 5.5.15 and prior or 6.0 pre-release builds. 7 days: Implement firewall-level network segmentation restricting SimpleHelp access; enforce IP whitelisting for technician endpoints; enable comprehensive authentication and session event logging with alerting for anomalous patterns. 30 days: Monitor vendor communications for first patched release; develop and test upgrade plan; escalate to SimpleHelp support for patch timeline if critical deployments at risk.

SimpleHelp CVE-2026-48558

Q: What is the CVSS score of CVE-2026-48558?

CVE-2026-48558 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-36509 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-12 VulnCheck

GHSA-m93h-gjv2-fmq2

Jwt Attack Authentication Bypass Simplehelp

9.5

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Remote unauthenticated forged JWT yields technician session controlling managed endpoints, so S:C with full CIA impact; AC:L because signature check is simply absent once OIDC is enabled.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jun 29, 2026 - 20:01 CISA

Patch available

Jun 12, 2026 - 19:01 EUVD

Analysis Generated

Jun 12, 2026 - 18:15 vuln.today

DescriptionCVE.org

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

Articles & Coverage 2

POC CVE-2026-48558: SimpleHelp OIDC JWT Signature Bypass Grants Unauthenticated Technician Access Jul 02, 2026 bleepingcomputer.com CVE-2026-48558: Critical SimpleHelp RCE Exploited to Deliver Djinn Stealer Across Platforms Jun 29, 2026

AnalysisAI

Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attackers to forge OIDC identity tokens and obtain fully authenticated technician sessions, because the server accepts ID tokens without verifying their cryptographic signature. Publicly available exploit code exists and the flaw can also bypass MFA in some configurations, making vulnerable remote-support deployments a high-priority target despite no current CISA KEV listing.

Technical ContextAI

SimpleHelp is a commercial remote-support and remote-access platform whose technician console can be fronted by OpenID Connect single sign-on. OIDC relies on ID tokens (JWTs) whose 'iss', 'aud', and identity claims must be trusted only after verifying the issuer's RSA/ECDSA signature against the IdP's JWKS. The CWE-347 'Improper Verification of Cryptographic Signature' root cause here means SimpleHelp parses the JWT body and trusts its claims (subject, email, groups) without validating the signature - a classic JWT 'alg:none' / unverified-signature pattern. The single CPE cpe:2.3:a:simplehelp:simplehelp covers all builds up to and including 5.5.15 and the 6.0 pre-release branch.

RemediationAI

Patch available per vendor advisory at https://simple-help.com/security/simplehelp-security-update-2026-05 - upgrade SimpleHelp to the fixed release listed there (a specific fixed version is not independently confirmed in the supplied data, so consult the advisory for the exact build number) and review the Horizon3 IOC writeup at https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ for compromise indicators before resuming production use. If immediate patching is impossible, disable OIDC authentication in the SimpleHelp admin console and revert technicians to local accounts with TOTP MFA, which removes the vulnerable code path entirely at the cost of losing SSO convenience; additionally restrict the technician console (typically TCP/443 of the SimpleHelp server) to known administrative IP ranges via firewall or reverse-proxy ACL to cut off remote unauthenticated reach, and rotate all technician credentials and OIDC client secrets after upgrade to invalidate any sessions or tokens that may have been minted by an attacker.