Summary
generated automatically from NVD dataSimpleHelp 5.5.15 and earlier, along with 6.0 pre-release versions, fail to verify the cryptographic signature of identity tokens in the OIDC authentication flow (CWE-347) when OIDC is configured. A remote, unauthenticated attacker can submit a forged token with arbitrary identity claims to gain a fully authenticated technician session, and in some configurations may also bypass multi-factor authentication, without any user interaction. The flaw is rated CRITICAL with a CVSS v3.1 score of 10.0 and is listed in the CISA KEV catalog as actively exploited.
NVD description
SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-29. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-07-02
EPSS · FIRST.org
5.7%probability of exploitation in the next 30 days
Higher than 92% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 12 juin 2026
- Updated
- 7 oct. 2026
- Status
- Analyzed
- Source
- disclosure@vulncheck.com
Affected products
Weaknesses (CWE)
References (5)
- https://simple-help.com/release-newsRelease Notes
- https://simple-help.com/security/simplehelp-security-update-2026-05PatchVendor Advisory
- https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/Technical DescriptionThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-347
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.