SimpleHelp Entra ID/OIDC Auth Bypass & Multi-Vulnerability Patch Summary

Vulnerability Overview SimpleHelp 5.5.16 closes a critical vulnerability, and all SimpleHelp users are advised to update. The vulnerability involves an administrator’s ability to control whether login links from unknown devices via Entra ID and OIDC can be linked to existing technician accounts, provided the email matches both the authentication token and the existing account. Affected Scope SimpleHelp 5.5.16: All users of SimpleHelp. Remediation Update to SimpleHelp 5.5.16: Ensure all SimpleHelp users update to the latest version to address this critical vulnerability. Review Security Notifications and Vulnerability Disclosure Guidelines: Visit the SimpleHelp security notifications and vulnerability disclosure guidelines for more information. Related Vulnerabilities SimpleHelp 5.5.12: - Vulnerability Overview: Resolved an issue allowing users to escalate privileges when installing remote access services, as well as preventing previously escalated services from continuing to run. - Affected Scope: All users of SimpleHelp 5.5.12. - Remediation: Update to SimpleHelp 5.5.12 or later. SimpleHelp 5.5.11: - Vulnerability Overview: Upgraded the server and client runtimes to version 17.0.15 and removed the hostname parameter from the download page to mitigate potential clickjacking attacks. - Affected Scope: All users of SimpleHelp 5.5.11. - Remediation: Update to SimpleHelp 5.5.11 or later. SimpleHelp 5.5.9: - Vulnerability Overview: Added additional protections to prevent server configuration leaks and improved password management in the SimpleHelp server. - Affected Scope: All users of SimpleHelp 5.5.9. - Remediation: Update to SimpleHelp 5.5.9 or later. Summary SimpleHelp has addressed critical vulnerabilities across multiple versions. It is recommended that all users promptly update to the latest version to ensure system security and stability. The specific versions requiring updates include 5.5.16, 5.5.12, 5.5.11, and 5.5.9.

Goal Reached Thanks to every supporter — we hit 100%!

SimpleHelp Entra ID/OIDC Auth Bypass & Multi-Vulnerability Patch Summary