CVE-2026-48558

The flaw is an authentication bypass in SimpleHelp's OIDC login flow, in versions 5.5.15 and earlier and 6.0 pre-release builds. When OIDC authentication is configured, the server accepts the identity tokens submitted during login without verifying their cryptographic signature. Because the signature is what proves a token was actually issued by the trusted identity provider, skipping that check lets a remote, unauthenticated attacker forge a token carrying arbitrary identity claims and present it to obtain a fully authenticated technician session. No user interaction is needed, and in some configurations the forged token can also sidestep multi-factor authentication.

SimpleHelp is remote-support software, so a technician session is a powerful position: it can reach and control the endpoints managed through the platform, making this an attractive lever for broad downstream access rather than a contained issue. That leverage over remote-access tooling is exactly what ransomware and access-broker actors seek. Upgrade to a fixed SimpleHelp release, keep the server's authentication endpoints restricted to trusted networks where feasible, and because a bypass leaves no failed-login trail, review technician session and access logs for unexpected logins and audit connected endpoints for unauthorized activity.