EUVD-2026-36509
GHSA-m93h-gjv2-fmq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed SimpleHelp server with OIDC
-
DeliveryForge JWT with target technician claims
-
ExploitPOST token to OIDC login endpoint
-
InstallServer skips signature verification
-
C2Receive authenticated technician session cookie
-
ExecuteUse console to push commands to managed endpoints
-
ImpactDeploy ransomware or exfiltrate data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires that the SimpleHelp server be running version 5.5.15 or earlier (or a 6.0 pre-release) AND be configured to use OIDC authentication for the technician console; instances using only built-in local accounts are not exposed via this code path. Beyond that, no authentication, no user interaction, and no privileged position on the network are needed - the attacker only needs network reach to the technician login endpoint (typically HTTPS on the SimpleHelp server) and the ability to submit an HTTP POST containing a forged ID token, and in some OIDC configurations the same forged token also defeats MFA enforcement. |
| Impact | This is a genuine top-priority issue, not a high-CVSS-low-real-risk case. CVSS 4.0 9.5 with AV:N/AC:L/PR:N/UI:N and H/H/H impact on both vulnerable and subsequent systems aligns with the description: a forged token yields a technician session, which in SimpleHelp translates to control of every endpoint that the server can reach. AT:P (attack requirements: present) only reflects that OIDC must be enabled - a deployment choice, not a hard barrier. Horizon3 has published technical details and IOCs and a public PoC exists, materially raising weaponization likelihood. CISA KEV does not yet list it and no EPSS score is provided in the input, so widespread mass-exploitation telemetry is not yet confirmed; given the SimpleHelp history of being abused by ransomware affiliates (CVE-2024-57727 line), targeted exploitation against exposed instances should be assumed imminent. |
| Exploit ScenarioDerived | An attacker locates an internet-exposed SimpleHelp server with OIDC enabled (Shodan/Censys fingerprinting), crafts a JWT whose payload claims a valid technician's subject/email and uses any signature (or 'alg:none'), and POSTs it to the OIDC callback. Because the signature is never verified, the server issues a fully authenticated technician session, after which the attacker uses SimpleHelp's built-in remote-access tooling to push commands or files to every connected endpoint - a path that the publicly available Horizon3 PoC demonstrates end-to-end. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 12, 2026
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attackers to forge OIDC identity tokens and obtain fully authenticated technician sessions, because the server accepts ID tokens without verifying their cryptographic signature. Publicly available exploit code exists and the flaw can also bypass MFA in some configurations, making vulnerable remote-support deployments a high-priority target despite no current CISA KEV listing.
RemediationAI
Patch available per vendor advisory at https://simple-help.com/security/simplehelp-security-update-2026-05 - upgrade SimpleHelp to the fixed release listed there (a specific fixed version is not independently confirmed in the supplied data, so consult the advisory for the exact build number) and review the Horizon3 IOC writeup at https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ for compromise indicators before resuming production use. If immediate patching is impossible, disable OIDC authentication in the SimpleHelp admin console and revert technicians to local accounts with TOTP MFA, which removes the vulnerable code path entirely at the cost of losing SSO convenience; additionally restrict the technician console (typically TCP/443 of the SimpleHelp server) to known administrative IP ranges via firewall or reverse-proxy ACL to cut off remote unauthenticated reach, and rotate all technician credentials and OIDC client secrets after upgrade to invalidate any sessions or tokens that may have been minted by an attacker.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SimpleHelp is a commercial remote-support and remote-access platform whose technician console can be fronted by OpenID Connect single sign-on. OIDC relies on ID tokens (JWTs) whose 'iss', 'aud', and identity claims must be trusted only after verifying the issuer's RSA/ECDSA signature against the IdP's JWKS. The CWE-347 'Improper Verification of Cryptographic Signature' root cause here means SimpleHelp parses the JWT body and trusts its claims (subject, email, groups) without validating the signature - a classic JWT 'alg:none' / unverified-signature pattern. The single CPE cpe:2.3:a:simplehelp:simplehelp covers all builds up to and including 5.5.15 and the 6.0 pre-release branch.
Know when Simplehelp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Remote unauthenticated forged JWT yields technician session controlling managed endpoints, so S:C with full CIA impact; AC:L because signature check is simply absent once OIDC is enabled.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Articles & Coverage 2
Executive ViewAI
SimpleHelp versions 5.5.15 and earlier contain a critical authentication bypass that allows remote unauthenticated attackers to forge identity tokens and obtain fully authenticated technician sessions, potentially bypassing MFA. This directly exposes remote-support deployments to unauthorized credential-free access, creating elevated risk of attacker impersonation and lateral movement into customer infrastructure.
Restrict network access via firewall rules and VPN-only connectivity; segment SimpleHelp from production customer systems; implement continuous logging and real-time alerting on all authentication events; enforce strict IP whitelisting; disable SimpleHelp remote-access capability entirely if business operations permit; require out-of-band approval workflows for technician session initiation; enhance logging to detect forged token patterns (impossible travel, anomalous locations, atypical access timing).
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Simplehelp
View allSimpleHelp remote support software contains multiple path traversal vulnerabilities allowing unauthenticated remote atta
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to creat
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file s
Exploit-DB