CVE-2026-48558: SimpleHelp OIDC Authentication Bypass (KEV)

Checked: 2026-10-29

CVE-2026-48558 is an authentication-bypass vulnerability in SimpleHelp remote-support software: when OIDC authentication is configured, the server accepts identity tokens during login without verifying their cryptographic signature, so a remote, unauthenticated attacker can submit a forged token to obtain a fully authenticated technician session, and CISA added it to the Known Exploited Vulnerabilities catalog.

Vulnerability summary

Vulnerability ID	CVE-2026-48558
CVSS score	10
EPSS score	0.7766
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2026-06-12T18:16:35.317

Affected components

Component	CPE	Version range
SimpleHelp	cpe:2.3:a:simple-help:simplehelp::::::::	5.5.15 and all earlier releases, and 6.0 pre-release builds (fixed in 5.5.16 and 6.0 RC2)

What this means

CVE-2026-48558 affects SimpleHelp, remote-support software used by managed service providers and IT help desks to take control of end-user machines. NVD's description states that versions 5.5.15 and prior, and 6.0 pre-release versions, contain "an authentication bypass vulnerability in the OIDC authentication flow": when OIDC is configured, "identity tokens submitted during login are accepted without verifying their cryptographic signature," letting "a remote, unauthenticated attacker submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session," in some configurations also bypassing multi-factor authentication, with no user interaction required (NVD).

The disclosing researcher's CNA submission, which NVD stores as a Secondary (not NVD-confirmed) metric, scores this CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction, and a scope change reflecting that a forged technician session can reach and control the remote end-user machines SimpleHelp manages; the same submission also records a CVSS v4.0 score of 9.5. CWE-347 (Improper Verification of Cryptographic Signature) is the assigned weakness (NVD).

SimpleHelp's own security notice confirms servers running 5.5.15 and earlier, and the 6.0 prerelease, are affected, states that "not all servers can be exploited" since it depends on server settings and network context, and provides fixed releases 5.5.16 and 6.0 RC2 (SimpleHelp Security Notice 2026-05).

The vulnerability was discovered and disclosed by Horizon3.ai, which published indicators of compromise for identifying exploitation attempts against vulnerable SimpleHelp installations (Horizon3.ai CVE-2026-48558 Disclosure).

CISA added CVE-2026-48558 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-29, with a required-action due date of 2026-07-02, and records knownRansomwareCampaignUse as "Unknown" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.7766 (99.563rd percentile) — among the highest EPSS scores seen on this site — consistent with active, widespread exploitation of internet-facing SimpleHelp servers (FIRST EPSS).

Because a successful forgery grants a full technician session with control over every endpoint the server manages, any SimpleHelp server running 5.5.15 or earlier, or a 6.0 prerelease, with OIDC authentication configured should be updated to 5.5.16 or 6.0 RC2 immediately and reviewed for signs of prior unauthorized technician sessions.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

SimpleHelp's OIDC login flow accepts identity tokens without verifying their cryptographic signature, letting a remote, unauthenticated attacker forge a token to obtain a fully authenticated technician session, in some configurations bypassing MFA too (CWE-347). — NVD
CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVSS v4.0: 9.5), submitted by the disclosing researcher's CNA and stored by NVD as a Secondary (not NVD-confirmed) metric. — NVD
Affected: SimpleHelp 5.5.15 and earlier, and 6.0 prerelease builds; fixed in 5.5.16 and 6.0 RC2. Vendor notes exploitability depends on server settings and network context. — SimpleHelp Security Notice 2026-05
The vulnerability was discovered and disclosed by Horizon3.ai, which published indicators of compromise for detecting exploitation. — Horizon3.ai CVE-2026-48558 Disclosure
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-29, required action due 2026-07-02; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
EPSS score is 0.7766 (99.563rd percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-4346: KNX Connection Authorization Account-Lockout DoSCVE-2023-4346: KEV overly restrictive account-lockout flaw in the KNX Connection Authorization Option 1 protocol used by building-automation devices, letting an attacker permanently brick a device. Sourced to NVD, CISA ICS-CERT and FIRST EPSS.