SimpleHelp OIDC JWT Authentication Bypass (CVE-2026-48558)

The CVE record says SimpleHelp accepts OpenID Connect (OIDC) identity tokens during login without verifying their cryptographic signature. A remote, unauthenticated attacker can submit a forged token with arbitrary identity claims and obtain a fully authenticated technician session. In some configurations this may also bypass multi-factor authentication, and no user interaction is needed.

SimpleHelp is a remote support and remote monitoring and management server. Technicians use it to connect to managed computers. Horizon3 says a technician can by default remote into managed endpoints and run scripts, so control of that role reaches the endpoints behind the server.

How the Bypass Works

OIDC lets a company hand user login to an identity provider, and SimpleHelp supports a generic OIDC type and an Azure Active Directory type. The identity provider returns a signed token that states who the user is. Per the CVE record, SimpleHelp read the claims in that token without checking the signature, so a made-up token passed.

Horizon3, the researcher who found the flaw, says an attacker can create and sign in as a new technician. It adds that MFA does not stop this, because technicians can register their own MFA method at first login. Horizon3 has withheld further technical detail.

Which Servers Can Be Exploited

SimpleHelp says not every server can be exploited, and that following the recommendations in its security guide makes exploitation much harder. Horizon3 lists three conditions: an OIDC provider is configured, a technician group has that provider enabled, and the setting "Allow group authenticated logins" is on for the group.

Horizon3 estimates that exposed SimpleHelp servers grew from roughly 3,400 in January 2025 to nearly 14,000. It says a random sample of them showed about 7.2 percent configured for the vulnerable OIDC login. These are Horizon3 figures, not ours.

Checking a Server for Signs of Abuse

Horizon3 gives these checks. In Administration, open Technicians, click the gear icon and tick "Show Group Authenticated Users", then look for technician names or email addresses you do not know. Review the server logs in Administration, or on the host at /opt/SimpleHelp/logs/server.log, for unfamiliar names and for configuration save entries naming a new technician.

SimpleHelp has had earlier critical flaws. Our page on the SimpleHelp path traversal CVE-2024-57727 covers one. Horizon3 says one of the flaws it disclosed in January 2025 reached CISA KEV in May 2025, and two more SimpleHelp flaws did in April 2026.

Exploitation Signals for CVE-2026-48558

These are the public signals we checked on 4 November 2026.

The CISA KEV catalog lists only flaws with evidence of exploitation. We did not run or link the repository. Horizon3 says it validated the flaw against real configurations in its customer base, which is research, not an attack report.

The vendor notice says SimpleHelp servers running 5.5.15 and earlier may be affected. The CVE record sets the range at 5.5.0 up to, but not including, 5.5.16, and adds 6.0 pre-release builds before 6.0 RC2.

SimpleHelp offers 5.5.16 to users of the 5.5 line and 6.0 RC2 to users of 6.0. Its notice says SimpleSetup users can pick Update, then Custom, and enter the update address https://simple-help.com/releases/5.5.16_202605. The vendor says action is required to secure the server.

The record does not say whether older major versions are affected. We therefore treat any SimpleHelp release older than 5.5.0 as unverified and suggest moving to a fixed release. Our vulnerability management guide covers how to plan the update.