# CVE-2026-48558: SimpleHelp authentication bypass in OIDC authentication flow

Source: https://junglewise.ai/threats/cve-2026-48558-simplehelp-authentication-bypass-in-oidc-authentication-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-48558 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-06-12

SimpleHelp, a remote support and management software, contains a critical security flaw in how it handles logins via OpenID Connect (OIDC). An attacker can bypass the login screen by providing a fake identity token that the system fails to verify, granting them full administrative access to the technician console. This allows unauthorized parties to control managed computers, access sensitive data, and potentially bypass multi-factor authentication.

Technologies: [SimpleHelp](https://junglewise.ai/threats/technologies/simplehelp). Vendors: [Simplehelp](https://junglewise.ai/threats/vendors/simplehelp).

## Quick answers

**Is CVE-2026-48558 exploited in the wild?** Yes. CVE-2026-48558 is known to be exploited in the wild, first recorded on 29 June 2026. Treat it as urgent.

**How severe is CVE-2026-48558?** Critical severity, with a CVSS score of 10, published 12 June 2026.

**Which products and versions are affected?** SimpleHelp 5.5.15 and prior, 6.0 pre-release versions, 5.5.15 and prior, 6.0 pre-release versions prior to 6.0 RC2.

**Is there a fix for CVE-2026-48558?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48558 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48558?** Check whether you run SimpleHelp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability (CWE-347) exists in SimpleHelp versions 5.5.15 and prior, as well as 6.0 pre-release versions. The root cause is a failure to verify the cryptographic signatures of OIDC identity tokens during the authentication flow. A remote, unauthenticated attacker can exploit this by submitting a forged JWT containing arbitrary identity claims. Successful exploitation results in a fully authenticated technician session and can bypass multi-factor authentication (MFA) if OIDC is the primary auth mechanism. The vulnerability has been reported as exploited in the wild.

## Affected products

- SimpleHelp SimpleHelp 5.5.15 and prior, 6.0 pre-release versions prior to 6.0 RC2

## Timeline

- 2026-06-12: disclosed
- 2026-06-12: advisory
- 2026-06-29: other: NVD publication date

## Related threats

- [SimpleHelp path traversal in ZIP file upload](https://junglewise.ai/threats/cve-2024-57728-simplehelp-path-traversal-in-zip-file-upload)
- [SimpleHelp privilege escalation via missing authorization in API key creation](https://junglewise.ai/threats/cve-2024-57726-simplehelp-privilege-escalation-via-missing-authorization-in-api)
- [SimpleHelp Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-57727-simplehelp-path-traversal-vulnerability)