Detections
Analytics

CVE-2026-48558

critical

Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

References

https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/

https://simple-help.com/security/simplehelp-security-update-2026-05

https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/

https://www.securityweek.com/critical-simplehelp-vulnerability-exploited-for-malware-delivery/

https://www.infosecurity-magazine.com/news/simplehelp-rmm-vulnerability/

https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/

https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html

https://securityaffairs.com/194503/security/u-s-cisa-adds-simplehelp-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials

https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/

https://www.helpnetsecurity.com/2026/06/16/simplehelp-rmm-cve-2026-48558/

https://www.bleepingcomputer.com/news/security/simplehelp-bug-lets-hackers-create-rogue-remote-support-accounts/

https://github.com/shunfeng8421/exploit-library

https://github.com/shunfeng8421/security-audit

https://github.com/wilsonvs/Cybersecurity-Research

https://github.com/Byungju/cve-research-lab

https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558

https://github.com/Alisha-chaudhary/cve-threat-intel-reports

https://github.com/VixianSchool/nuclei-cve-check

https://github.com/Hector-Abarca/realrisk-checks

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558

https://simple-help.com/release-news

Details

Source: Mitre, NVD

Published: 2026-06-12

Updated: 2026-06-30

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 10

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 9.5

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.64313

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest