CVE-2026-48558: SimpleHelp Authentication Bypass Vulnerability

SimpleHelp contains an authentication bypass vulnerability in its OIDC authentication flow. When OIDC is enabled, the product accepts identity tokens during login without verifying their cryptographic signature. A remote unauthenticated attacker can therefore submit a forged token with arbitrary claims and obtain a fully authenticated technician session; in some setups this also bypasses multi-factor authentication.

How it works

The flaw belongs to CWE-347, improper verification of cryptographic signatures. In the OIDC login path the application receives an identity token but does not check the signature that should prove the token was issued by the configured identity provider. An attacker who can reach the login endpoint can therefore craft a token containing any desired identity claims and present it as valid.

Because the bypass occurs at the point of token acceptance, the resulting session carries whatever privileges are mapped to those claims, including technician access. The vulnerability is configuration-dependent and only affects deployments that have turned on OIDC authentication.

Am I affected? How to find it in your systems

• Inventory all SimpleHelp servers and hosted instances that are reachable from the internet or untrusted networks.
• Review each instance’s authentication settings to determine whether OIDC is enabled.
• Confirm the exact product version and configuration details against the vendor advisory, as only certain builds and OIDC setups are affected.
• Examine authentication logs for successful technician logins that originate from unexpected sources or that lack corresponding identity-provider records.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, re-verify that OIDC tokens are now validated according to the identity provider’s requirements and that multi-factor authentication remains enforced where configured.

• Disable OIDC authentication if it is not required for operations.
• Restrict network access to the SimpleHelp administrative interface to only trusted management networks.
• Ensure that any identity-provider configuration enforces proper audience, issuer, and signature checks at the provider level as an additional control.

If you can't patch immediately

• Place SimpleHelp servers behind a network segmentation boundary that prevents direct access from untrusted networks.
• Disable the OIDC authentication method until the update can be applied.
• Monitor authentication and session-creation logs for anomalous technician logins and alert on any activity that cannot be correlated to legitimate identity-provider events.
• Follow CISA BOD 26-04 guidance for prioritizing and applying security updates, including evaluation of internet exposure for each asset.

If your data may have been exposed

Authentication bypass vulnerabilities that are actively exploited can lead to unauthorized access and subsequent data exposure. You can run a free exposure scan of your email addresses against known breach data to check for signs of prior compromise.