CVE-2026-48558
published 2026-06-12CVE-2026-48558: SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC…
PriorityP195critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-07-02
Exploited in the wild
EPSS
5.72%
93.0th percentile
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| simple-help | simplehelp | < 5.5.16 | 5.5.16 |
| simple-help | simplehelp | — | — |
| simplehelp | simplehelp | >= 5.5.0 < 5.5.16 | 5.5.16 |
| simplehelp | simplehelp | >= 6.0 < 6.0 RC2 | 6.0 RC2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Hunt for new authenticated Technician accounts with unknown or suspicious names and/or email addresses in SimpleHelp logs, as these may indicate exploitation of CVE-2026-48558. ↗
- →Detect TaskWeaver loader activity by monitoring for node.exe executing a file named jquery.js, which is anomalous for a remote management context. ↗
- →Monitor for outbound connections to a.dev-tunnels[.]com from managed endpoints, which is used by TaskWeaver as its C2 channel. ↗
- →Monitor for outbound connections to 96.126.130[.]126 on port 58942, used by Djinn Stealer to exfiltrate data packed as a GZIP-compressed TAR archive. ↗
- →On Linux endpoints managed by SimpleHelp, alert on processes reading /proc/*/cmdline and /proc/*/environ in bulk, a technique used by Djinn Stealer to harvest secrets from process memory. ↗
- ·CVE-2026-48558 only affects SimpleHelp servers with OIDC authentication configured (generic OIDC or Azure AD OIDC); servers using other authentication methods are not vulnerable. ↗
- ·MFA bypass is possible because on first login, a newly self-registered rogue Technician account can register its own MFA method before MFA is enforced. ↗
- ·Shodan data indicates approximately 14,000 SimpleHelp servers are internet-exposed, with roughly 7.2% configured to use OIDC — these are the directly at-risk population. ↗
- ·If patching to 5.5.16 or 6.0RC2 is not immediately possible, IP-based allowlists restricting technician login sources serve as a partial mitigation. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv4.09.5CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck10.0CRITICAL
cisa10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
SimpleHelp Authentication Bypass Vulnerability
cisa·2026-06-29·CVSS 10.0
CVE-2026-48558 [CRITICAL] CWE-347 SimpleHelp Authentication Bypass Vulnerability
Vulnerability: SimpleHelp Authentication Bypass Vulnerability
Affected: SimpleHelp SimpleHelp
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forens
VulDB
SimpleHelp up to 5.5.15/6.0 RC1 Multi-Factor Authentication signature verification
vuldb·2026-06-12·CVSS 10.0
CVE-2026-48558 [CRITICAL] SimpleHelp up to 5.5.15/6.0 RC1 Multi-Factor Authentication signature verification
A vulnerability classified as critical has been found in SimpleHelp up to 5.5.15/6.0 RC1. Affected is an unknown function of the component Multi-Factor Authentication. Performing a manipulation results in improper verification of cryptographic signature.
This vulnerability is reported as CVE-2026-48558. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow.
ghsa_unreviewed·2026-06-12
CVE-2026-48558 [CRITICAL] CWE-347 SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow.
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
GHSA
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
ghsa·2026-03-26
CVE-2026-33536 [MEDIUM] CWE-121 ImageMagick has an Out-of-bounds Write via InterpretImageFilename
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
Due to an incorrect return value on certain platforms a pointer is incremented past the end of a buffer that is on the stack and that could result in an out of bounds write.
```
==48558==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x00016b9b7490 at pc 0x0001046d48ac bp 0x00016b9b31d0 sp 0x00016b9b31c8
WRITE of size 1 at 0x00016b9b7490 thread T0
```
VulnCheck
SimpleHelp Authentication Bypass Vulnerability
vulncheck·2026·CVSS 10.0
CVE-2026-48558 [CRITICAL] CWE-347 SimpleHelp Authentication Bypass Vulnerability
SimpleHelp Authentication Bypass Vulnerability
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
Affected: SimpleHelp SimpleHelp
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Req
No detection rules found.
Nuclei
SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass
nuclei·CVSS 10.0
CVE-2026-48558 [CRITICAL] SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass
SimpleHelp 15) { return; }
http(2);
var providers_raw = template["providers_raw"];
if (!providers_raw) { return; }
var providers;
try {
providers = JSON.parse(providers_raw);
} catch (e) { return; }
if (!providers || !providers[0]) { return; }
var provider = null;
for (var i = 0; i ]+)/);
if (!state_m) { return; }
var nonce_m = auth_url.match(/[?&]nonce=([^&\s"'<>]+)/);
var nonce = nonce_m ? nonce_m[1] : "";
function b64url(s) {
var CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
var bytes = [];
for (var c = 0; c > 2];
out += CHARS[((b0 & 3) > 4))];
if (b1 >= 0) { out += CHARS[((b1 & 15) > 6))]; }
if (b2 >= 0) { out += CHARS[b2 & 63]; }
}
return out;
}
var now = Math.floor(new Date().getTime() / 1000);
var jwt_header = {"alg":"none","typ":"JWT"};
var jwt_p
Metasploit
SimpleHelp OIDC Authentication Bypass Remote Code Execution
metasploit·CVSS 10.0
CVE-2026-48558 [CRITICAL] SimpleHelp OIDC Authentication Bypass Remote Code Execution
SimpleHelp OIDC Authentication Bypass Remote Code Execution
This module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelp's legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An OIDC provider must be enabled for a technician group that permits group-authenticated logins. The group must be allowed to access the selected machine and run remote commands. The SimpleHelp server must have a valid session license, and at least one managed machine must be online. SimpleHelp 5.5.0 through 5.5.15 are affected. Some SimpleHelp 6.0 prerelease builds before 6.0 RC2 are also affected.
Rapid7
Metasploit Wrap Up: This One Goes to Sixteen!
blogs_rapid7·2026-09-11·CVSS 8.4
CVE-2025-66516 [HIGH] Metasploit Wrap Up: This One Goes to Sixteen!
## This One Goes to Sixteen!
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
## New module content (16)
## Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read
Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon
Type: Auxiliary
Pull request: #21739 contributed by kmkz
Path: scanner/http/elasticsearch_tika_xfa_xxe
CVE reference: CVE-2025-66516
Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed thro
Talos
Catan and Mouse
blogs_talos·2026-07-02
CVE-2026-48558 Catan and Mouse
## Catan and Mouse
Welcome to this week’s edition of the Threat Source newsletter.
“I do not know everything; still many things I understand.” ― Madeleine L'Engle, A Wrinkle in Time
“Don't try to comprehend with your mind. Your minds are very limited. Use your intuition.” ― Madeleine L'Engle, A Wind in the Door
The World Cup. The 4 th of July as the US turns 250. Dungeon Crawler Carl. LeBron moving on. Wimbledon. AI. There are so many things that I could draw a parallel to farm for this week’s newsletter content. So let’s talk about board games. A lot of skills come and go, and your journey with cybersecurity will be full of tools that you learn and then are gone. It’s a never-ending journey of learning. And it’s honestly the best thing about this career path for the kind of minds that
Hackernews
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
blogs_hackernews·2026-06-30·CVSS 10.0
CVE-2026-48558 [CRITICAL] Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer .
The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0), a critical authentication bypass vulnerability impacting the OpenID Connect (OIDC) flow that an unauthenticated attacker could exploit to obtain a fully authenticated "Technician session by submitting a forged token containing arbitrary identity claims.
"TaskWeaver
Hackernews
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
blogs_hackernews·2026-06-22·CVSS 9.8
CVE-2026-24858 [CRITICAL] ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
It’s Monday again.
This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control.
The annoying part is how little of this feels new. Weak credentials, sketchy downloads, browser extensions with too much access, and WordPress sites are used to push more attacks. Nothing clever. Just sloppy, cheap, and effective.
Here’s the Monday recap. Let’s get into the week’s mess.
## ⚡ Threat of the We
Bleepingcomputer
SimpleHelp bug lets hackers create rogue remote support accounts
blogs_bleepingcomputer·2026-06-15·CVSS 10.0
CVE-2026-48558 [CRITICAL] SimpleHelp bug lets hackers create rogue remote support accounts
## SimpleHelp bug lets hackers create rogue remote support accounts
## Bill Toulas
A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol.
The flaw is tracked as CVE-2026-48558 and received a critical severity rating. It impacts SimpleHelp versions 5.5.15 and older, as well as 6.0 pre-release versions.
Researchers at offensive security company Horizon3.ai explain that the issue is caused by how identity assertions received from an OIDC identity provider (IdP) are validated.
When OIDC authentication is enabled, an unauthenticated attacker can create and log in as a new Technician user without needing to go through the multi-factor authentica
https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/https://simple-help.com/release-newshttps://simple-help.com/security/simplehelp-security-update-2026-05https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558
2026-06-12
Published
2026-06-29
Added to CISA KEV
Exploited in the wild