Skip to main content
Change Risk Intel
CVE tracker

CVE-2026-48558 — SimpleHelp Authentication Bypass Vulnerability

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of…

CVSS
9.8 (Critical)
KEV status
CISA KEV — Listed
First seen (CISA KEV)
Recommended change window
Emergency change — SimpleHelp is a remote-support tool; patch within 24 hours and rotate any technician credentials that could have been used since May 2026.
Vendor advisory
https://simple-help.com/security/simplehelp-security-update-2026-05
Affected products
SimpleHelp SimpleHelp

Why this one matters to a CAB

SimpleHelp is a remote-support tool — technicians use it to take over end-user machines. An OIDC signature-verification bypass means an attacker can mint a forged identity token that SimpleHelp accepts as a valid technician login, potentially bypassing MFA in the process. Every SimpleHelp session issued during the exposure window becomes suspect.

Defender’s angle

  • Assume-breach posture: rotate every technician credential that has been used since the earliest possible exposure date (SimpleHelp’s advisory points to May 2026). Rotating after the patch is not sufficient.
  • Session audit: pull the SimpleHelp session log and correlate every remote session with a corresponding help-desk ticket. An unattributed session is an incident.
  • OIDC provider hygiene: whatever IdP SimpleHelp federates with, confirm the iss and aud claim validation is enforced at the IdP as well as at SimpleHelp. Defense in depth applies to token verification too.

What to bring to CAB

A change record that includes (1) the SimpleHelp patch install, (2) a credential-rotation run book, and (3) a session-log audit finding sheet. All three must be signed off.

Sources

This page summarizes publicly available information from CISA KEV, NVD, and the listed vendor advisory. Change Risk Intel does not publish exploit walkthroughs. Verify with your vendor before scheduling any change window.