Loading vulnerability…
CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management software. Affected versions accept OpenID Connect identity tokens during login without verifying the token's cryptographic signature. Because the OIDC authentication flow trusts unsigned or forged identity assertions, a remote attacker can submit a crafted token containing arbitrary identity claims and be treated as a valid authenticated user. The flaw affects SimpleHelp 5.5.15 and earlier and 6.0 pre-release versions prior to 6.0 RC2. In vulnerable deployments, successful exploitation yields a fully authenticated Technician session and can also bypass multi-factor authentication in some configurations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept for CVE-2026-48558, an authentication bypass in SimpleHelp OIDC handling. It contains two files: a README with vulnerability background, affected versions, mitigation guidance, and usage examples; and poc.py, the actual exploit implementation. The exploit logic is straightforward and operational. The script accepts a target base URL and attacker-controlled OIDC claim values, auto-discovers likely OIDC callback endpoints by probing several common paths, forges a JWT id_token (defaulting to alg=none, with optional HS256), and submits it as form data to the discovered callback endpoint. It then evaluates success heuristically by checking HTTP status, redirect targets, response text keywords such as technician/dashboard/admin/console, and presence of likely authentication cookies. If successful, it saves session cookies to session.json. Main capabilities: - Automatic discovery of likely SimpleHelp OIDC callback endpoints - Forging unsigned or weakly signed JWT/OIDC id_tokens with arbitrary claims - Submission of forged id_token to the target callback endpoint - Basic success detection via response content, redirects, and cookies - Session cookie capture and local storage The attack vector is web-based and remote. The exploit targets vulnerable SimpleHelp servers where OIDC is enabled and token signature validation is not enforced. The code is not a scanner or detector; it is an active exploitation PoC intended to obtain authenticated technician access.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
208 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability affecting the SimpleHelp remote support platform. The content appears to contain a duplicated CVE suffix.
A vulnerability in the SimpleHelp remote support platform.
A CVSS 10.0 vulnerability affecting SimpleHelp.
A vulnerability in the SimpleHelp remote support platform mentioned in related news.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.