SimpleHelp CVE-2026-48558 OIDC Authentication Bypass Analysis

Vulnerability Overview Vulnerability ID: CVE-2026-48558 Vulnerability Name: SimpleHelp Authentication Bypass Indicators of Compromise Discoverer: Zach Hanley Release Date: June 12, 2026 Impact Scope Affected Software: SimpleHelp Vulnerability Type: Authentication Bypass Specific Impact: - Attackers can exploit this vulnerability to bypass SimpleHelp’s authentication mechanism and create and authenticate as new “Technician” users. - This vulnerability affects SimpleHelp servers configured to use the OIDC (OpenID Connect) authentication method. - Even if the SimpleHelp server has mandatory MFA (Multi-Factor Authentication) enabled, attackers can bypass MFA by self-registering as a Technician during the first login. Remediation Patch Information: It is recommended to upgrade to the latest version; see the “here” link on the page for the patch link. Temporary Mitigations: - Apply IP restrictions to limit the source of Technician authentication. - Review server logs for unauthorized Technician login records. Other Key Information Vulnerability Discovery Process: - In January 2026, Horizon3.ai discovered multiple critical vulnerabilities in SimpleHelp during research. - In May 2026, one of the vulnerabilities was added to CISA’s KEV (Known Exploited Vulnerabilities) list. - In June 2026, Horizon3.ai discovered and reported this vulnerability again. Exploitation Conditions: - OIDC is enabled, with at least one OIDC authentication provider configured. - A TechnicianGroup is associated with an OIDC provider, with at least one TechnicianGroup having an OIDC provider enabled. - The “Allow Group Authentication Login” option is enabled in the TechnicianGroup. Internet Exposure: - In January 2026, approximately 3,400 SimpleHelp servers were exposed to the internet. - As of June 2026, the number of exposed servers increased to approximately 14,000. - Random sampling indicated that approximately 7.2% of the servers were configured with the vulnerable OIDC authentication method. Disclosure Timeline May 21, 2026: Authentication bypass vulnerability discovered; CVE-2026-48558 assigned. May 21, 2026: Verified that the vulnerability is exploitable in real-world conditions. May 22, 2026: Vulnerability reported to SimpleHelp. May 22, 2026 – June 1, 2026: Further communication with SimpleHelp regarding vulnerability details. June 9, 2026: Discovered that SimpleHelp had released a patch without notifying Horizon3.ai. June 12, 2026: This blog post was published. References SimpleHelp Security Update Summary This vulnerability allows attackers to bypass SimpleHelp’s authentication mechanism to create and authenticate as new Technician users, thereby executing privileged management activities. It is recommended to upgrade to the latest version as soon as possible and implement temporary mitigations, such as applying IP restrictions and reviewing server logs.

Goal Reached Thanks to every supporter — we hit 100%!

SimpleHelp CVE-2026-48558 OIDC Authentication Bypass Analysis