CVE-2026-48558: SimpleHelp authentication bypass in OIDC authentication flow

CVE-2026-48558 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-06-12

SimpleHelp, a remote support and management software, contains a critical security flaw in how it handles logins via OpenID Connect (OIDC). An attacker can bypass the login screen by providing a fake identity token that the system fails to verify, granting them full administrative access to the technician console. This allows unauthorized parties to control managed computers, access sensitive data, and potentially bypass multi-factor authentication.

Technologies: SimpleHelp. Vendors: Simplehelp.

Quick answers

Is CVE-2026-48558 exploited in the wild?
Yes. CVE-2026-48558 is known to be exploited in the wild, first recorded on 29 June 2026. Treat it as urgent.
How severe is CVE-2026-48558?
Critical severity, with a CVSS score of 10, published 12 June 2026.
Which products and versions are affected?
SimpleHelp 5.5.15 and prior, 6.0 pre-release versions, 5.5.15 and prior, 6.0 pre-release versions prior to 6.0 RC2.
Is there a fix for CVE-2026-48558?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48558 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48558?
Check whether you run SimpleHelp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability (CWE-347) exists in SimpleHelp versions 5.5.15 and prior, as well as 6.0 pre-release versions. The root cause is a failure to verify the cryptographic signatures of OIDC identity tokens during the authentication flow. A remote, unauthenticated attacker can exploit this by submitting a forged JWT containing arbitrary identity claims. Successful exploitation results in a fully authenticated technician session and can bypass multi-factor authentication (MFA) if OIDC is the primary auth mechanism. The vulnerability has been reported as exploited in the wild.

Affected products

  • SimpleHelp SimpleHelp 5.5.15 and prior, 6.0 pre-release versions prior to 6.0 RC2

Timeline

  • 2026-06-12: disclosed
  • 2026-06-12: advisory
  • 2026-06-29: other: NVD publication date

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.