Loading vulnerability…
CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management software. Affected versions accept OpenID Connect identity tokens during login without properly verifying the token's cryptographic signature. Because the OIDC authentication flow trusts unsigned or forged identity assertions, a remote attacker can submit a crafted token containing arbitrary identity claims and be treated as an authenticated technician. The issue affects SimpleHelp 5.5.15 and earlier, and 6.0 pre-release builds prior to 6.0 RC2. In deployments using group-authenticated OIDC logins, the flaw can permit creation or use of a fully authenticated technician session without valid credentials, and in some configurations it can also bypass multi-factor authentication.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept for CVE-2026-48558, an authentication bypass in SimpleHelp OIDC handling. It contains two files: a README with vulnerability background, affected versions, mitigation guidance, and usage examples; and poc.py, the actual exploit implementation. The exploit logic is straightforward and operational. The script accepts a target base URL and attacker-controlled OIDC claim values, auto-discovers likely OIDC callback endpoints by probing several common paths, forges a JWT id_token (defaulting to alg=none, with optional HS256), and submits it as form data to the discovered callback endpoint. It then evaluates success heuristically by checking HTTP status, redirect targets, response text keywords such as technician/dashboard/admin/console, and presence of likely authentication cookies. If successful, it saves session cookies to session.json. Main capabilities: - Automatic discovery of likely SimpleHelp OIDC callback endpoints - Forging unsigned or weakly signed JWT/OIDC id_tokens with arbitrary claims - Submission of forged id_token to the target callback endpoint - Basic success detection via response content, redirects, and cookies - Session cookie capture and local storage The attack vector is web-based and remote. The exploit targets vulnerable SimpleHelp servers where OIDC is enabled and token signature validation is not enforced. The code is not a scanner or detector; it is an active exploitation PoC intended to obtain authenticated technician access.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
203 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A CVSS 10.0 vulnerability affecting SimpleHelp.
A SimpleHelp vulnerability involving an authentication bypass in OIDC.
A critical authentication bypass vulnerability in SimpleHelp affecting deployments configured with OpenID Connect (OIDC) authentication, caused by improper validation of identity tokens and failure to verify cryptographic signatures, allowing remote unauthenticated attackers to forge tokens and gain technician-session access.
A critical authentication bypass vulnerability in SimpleHelp RMM servers using generic OIDC or Azure Active Directory OIDC authentication that allows unauthenticated attackers to forge an identity token and gain a fully authenticated Technician session, potentially bypassing MFA and enabling privileged remote administration.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.