A vulnerability in SimpleHelp’s OIDC authentication flow allows unauthenticated remote attackers to submit forged identity tokens and gain full technician access, potentially bypassing MFA in some configurations.
Summary
- CVE-2026-48558 affects SimpleHelp when OIDC authentication is configured, allowing identity token forgery due to missing signature verification.
- A remote, unauthenticated attacker can craft arbitrary identity claims and obtain a fully authenticated technician session.
- In some configurations, the vulnerability also enables bypass of multi-factor authentication.
- CISA has added this to the Known Exploited Vulnerabilities catalogue with a remediation due date of 2 July 2026.
- Organisations must apply vendor mitigations, assess internet exposure, and comply with BOD 26-04 patching guidelines.
What the vulnerability is
CVE-2026-48558 is an authentication bypass vulnerability in SimpleHelp’s implementation of OpenID Connect (OIDC) authentication. When OIDC is configured as the authentication method, the product accepts identity tokens submitted during login without verifying their cryptographic signatures. This means the server takes the token’s claims at face value rather than confirming the token was actually issued and signed by a trusted identity provider.
The practical risk
The consequence is significant. A remote, unauthenticated attacker with network access to a vulnerable SimpleHelp instance can craft a forged token, populate it with arbitrary identity claims — including claims that map to a legitimate or privileged technician account — and present it to the server. The server accepts the token and issues a fully authenticated technician session. No credentials, no prior account access, no inside knowledge beyond the existence of the endpoint is required.
MFA bypass in scope
CISA’s advisory notes that in some configurations, this vulnerability also allows bypass of multi-factor authentication. The precise conditions under which MFA is circumvented are not detailed in the available source material, but the implication is that organisations relying on MFA as a compensating control for remote access through SimpleHelp should not consider it a reliable backstop against this specific attack path.
Why SimpleHelp is an attractive target
SimpleHelp is a remote access and support platform commonly used by managed service providers and internal IT teams. Technician accounts within such tools typically carry broad privileges — the ability to connect to endpoints, execute commands, and access customer or internal systems. An attacker who successfully forges a technician session effectively inherits those capabilities. The value to a threat actor is obvious: remote access tooling is a well-established initial access and lateral movement vector.
CISA’s classification and timeline
CISA has added this vulnerability to its Known Exploited Vulnerabilities catalogue, which indicates evidence or reasonable basis to believe the vulnerability has been or is being exploited in the wild. The required remediation due date under BOD 26-04 is 2 July 2026. Organisations subject to that binding directive must apply vendor mitigations by that date. For cloud-hosted deployments, applicable BOD 26-04 guidance for cloud services applies. Where mitigations are not available, CISA’s instruction is to discontinue use of the product.
Scope of exposure
The vulnerability only affects deployments where OIDC authentication has been configured. SimpleHelp installations using other authentication methods are not described as affected by this specific flaw in the available source material. That said, organisations should not assume a non-OIDC configuration eliminates all risk; CISA’s guidance explicitly directs stakeholders to evaluate each asset’s internet exposure individually and ensure compliance with patching timelines regardless of perceived exposure.
Forensic considerations
CISA’s required action references specific forensic triage requirements alongside the patching guidance, suggesting that organisations should not simply patch and move on. A forged token authentication event may leave limited conventional traces, given that the server processed the authentication as legitimate. Security teams should review authentication logs for anomalous OIDC login events, particularly those establishing technician sessions from unfamiliar source addresses or at unusual times, prior to or concurrent with applying fixes.
Why it matters
Remote access tooling sits at the intersection of privileged access and broad network reach — precisely the combination adversaries seek. An unauthenticated attacker who can forge a technician session in SimpleHelp may be positioned to move laterally across managed endpoints, exfiltrate data, or deploy further tooling before detection. For CISOs, the MFA bypass element is particularly significant: it removes a control that many organisations treat as a reliable second line of defence. If your environment uses SimpleHelp with OIDC, this is a high-priority item regardless of CISA’s federal directive scope. Assess exposure, apply mitigations promptly, and treat your authentication logs from the affected period as potentially unreliable for establishing a clean bill of health without deeper forensic review.
What to do now
- Determine whether any SimpleHelp deployments in your environment are configured to use OIDC authentication and prioritise those instances for immediate action.
- Apply mitigations in accordance with SimpleHelp vendor instructions as directed by CISA.
- Assess internet exposure for all SimpleHelp assets and ensure adherence to BOD 26-04 patching timelines, with a hard deadline of 2 July 2026.
- For cloud-hosted SimpleHelp deployments, follow the applicable BOD 26-04 guidance specific to cloud services.
- If vendor mitigations are unavailable, follow CISA’s guidance to discontinue use of the product.
- Conduct forensic triage of authentication logs in line with CISA’s referenced forensic triage requirements, looking for anomalous OIDC-based technician session establishment.
- Do not rely on MFA as a compensating control for this vulnerability in affected configurations.
