Authentication bypass in SimpleHelp remote support (CVE-2026-48558) — forged tokens grant technician sessions; a perfect CVSS 10.0
SimpleHelp, a remote-support (remote-access) tool, fails to verify the cryptographic signature of identity tokens in its OIDC login flow. A remote, unauthenticated attacker can submit a forged token and obtain a fully authenticated technician session — potentially bypassing MFA. The NVD-registered score is CVSS 10.0 (CRITICAL). CISA added it to KEV on June 29, 2026.
Key facts
- CVE IDCVE-2026-48558
- CVSS base score10 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Affected (vendor / product)SimpleHelp SimpleHelp
- CWECWE-347
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-07-02 (U.S. federal civilian agencies, BOD 22-01)
Key points
- SimpleHelp (≤5.5.15 and 6.0 pre-releases) accepts OIDC identity tokens without verifying their cryptographic signature (CWE-347)
- A remote, unauthenticated attacker can forge a token and obtain a full technician session — the doorway to the managed endpoint fleet; MFA can be bypassed in some configurations
- NVD-registered score: CVSS 10.0 (CRITICAL) — the maximum
- Added to KEV June 29, 2026; remediation due July 2 — a 3-day, top-priority deadline (BOD 26-04)
- RMM/remote-support tools are favorite ransomware entry points — this product saw another flaw abused in 2025
OIDC (OpenID Connect) is the single-sign-on standard: log in once at your identity provider and it vouches for you to each application via a signed "identity token." Signature verification is the lifeline of the whole scheme — and this flaw is the fundamental implementation failure of not doing it.
Without verification, the token is just a self-written name tag: an attacker can mint one claiming to be an administrator and walk in. Adding MFA does not help when the foundation of the login flow itself is broken, which is why bypass is possible in some configurations.
What amplifies the severity is the nature of the product. Remote-support / remote-management (RMM) tools like SimpleHelp exist so help-desk technicians can operate many customer or corporate endpoints remotely; stealing a "technician session" hands over the doorway to the entire managed fleet.
Break one tool, reach many environments — this structure is exactly why RMM tools have been consistently favored by ransomware operators. SimpleHelp itself saw a different vulnerability abused in 2025 as a ransomware entry point through managed-service providers, and this KEV listing (confirmed exploitation) sits on that same trajectory.
The baseline response is applying the vendor's security update (its May 2026 advisory), with OIDC-configured deployments the most urgent. A three-day remediation deadline signals top-priority treatment under CISA's BOD 26-04. Remote-support tools are, by nature, often reachable from outside — a reminder that the tools that manage everything else must be defended first.
Why it matters
When the tool that manages endpoints is breached, the blast radius is the entire managed fleet — a supply-chain-style impact. Organizations whose help desks or MSPs use RMM tooling should immediately verify versions and OIDC configuration. A perfect CVSS score, a 3-day deadline, and a prior ransomware history line up every signal that this belongs at the top of the pile.
FAQ
What is OIDC (OpenID Connect)?
Does MFA protect us?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).