CVE-2026-48558

SimpleHelp 6.0 contains a critical authentication bypass in its OIDC implementation: the server accepts identity tokens without verifying cryptographic signatures. This is not a weak cryptographic configuration — it's the complete absence of the foundational trust mechanism that OIDC provides. An attacker who knows the configured client ID and can reach the SimpleHelp server can forge identity tokens locally and authenticate as any user, including administrators. No compromise of the identity provider is required. The vulnerability affects pre-release versions of SimpleHelp 6.0. If you are running SimpleHelp 6.0 in production, verify you have applied any available patches. SimpleHelp's OIDC implementation replaces traditional password authentication entirely in standard deployments, meaning forged tokens provide full session access regardless of whether MFA is configured elsewhere. For defenders: confirm your current SimpleHelp version and check vendor advisories for the patched release. Review your OIDC configuration to ensure the client secret and identity provider settings have not been exposed. Because SimpleHelp accepts tokens without signature validation, authentication logs will not show cryptographic verification failures — there is no forensic signal differentiating forged tokens from legitimate ones. This means you cannot rely on existing logs to detect exploitation; focus instead on patching and on monitoring for unexpected new user accounts or administrative sessions originating from unusual IP ranges. The root cause indicates this OIDC feature was likely developed separately from the core authentication framework, using JWT decoding without proper OIDC library integration. Ensure your incident response plan accounts for the possibility that this vulnerability may have been exploited pre-patch, given the pre-release exposure window.

Reviewed through automated stages and approved by a human before publication.