Exploited vulnerability

CVE-2026-48558

TLP:CLEAR

SimpleHelp Authentication Bypass Vulnerability

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

Facts

Vendor: SimpleHelp
Product: SimpleHelp
CVSS: 10
EPSS (probability of exploitation within 30 days): 77.7 %
On CISA's Known Exploited Vulnerabilities list since: 29 June 2026
First known exploitation: 29 June 2026
CISA's deadline for US federal agencies: 2 July 2026
Weakness: CWE-347
First seen by Risk Letters: 12 June 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD