CVE-2026-48558: SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

Synopsis

Authentication bypass in SimpleHelp (versions 5.5.0 through 5.5.15 and 6.0 pre-release builds) stems from the OIDC login flow accepting identity tokens without verifying their cryptographic signature. A remote, unauthenticated attacker can reach the login endpoint over the network, submit a forged token with arbitrary identity claims, and obtain a fully authenticated technician session, potentially bypassing multi-factor authentication in some configurations. Successful exploitation gives the attacker complete control over the SimpleHelp technician interface, enabling data access, configuration changes, and disruption of remote-support sessions. A patched-image rebuild at versions 5.5.16 and 6.0 RC2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SimpleHelp login endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credentials of any kind are required; the forged OIDC token replaces the need for any legitimate credential.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link, open a file, or take any other action.

• Attack complexityDetail

  Base exploit mechanics are reliable and condition-free, though the CVSS AT:P token indicates a specific prerequisite configuration (OIDC authentication must be enabled on the SimpleHelp instance) must be present for the vulnerability to be reachable.

Blast Radius

• Attacker obtains a fully authenticated technician session, gaining the same access level as a legitimate SimpleHelp technician including ability to initiate and control remote-support connections to managed endpoints.
• Attacker reads session data, stored credentials, and endpoint configuration held within the SimpleHelp server.
• Attacker modifies technician accounts, access-control settings, and remote-support policies, persisting unauthorized access beyond the initial session.
• In configurations with MFA enforced, the bypass also nullifies that second authentication factor, removing that compensating control entirely.