SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass

Key facts for SimpleHelp OIDC auth bypass

Detection coverage for SimpleHelp OIDC auth bypass

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0820 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SimpleHelp Rogue Technician Registration via Forged OIDC Token (CVE-2026-48558) — Exploitation

Detects the core CVE-2026-48558 exploitation primitive in SimpleHelp server.log: a forged/unsigned OIDC identity token is accepted without signature verification (CWE-347), causing the server to register a new 'group authenticated' Technician login. Fires on 'Registering technician login for' paired with the '[New Anon]' / 'Configuration save requested (Forged Attacker' markers that accompany on-the-fly anonymous technician creation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1606.002, T1136.001
• Data sources: simplehelp:server, /opt/SimpleHelp/logs/server.log, SimpleHelpServer_CL
• Severity: critical
• Confidence: high

Splunk SPL

index=rmm sourcetype="simplehelp:server" source="/opt/SimpleHelp/logs/server.log" ("Registering technician login for" OR "[New Anon]" OR "Configuration save requested (Forged Attacker")
| rex field=_raw "Registering technician login for (?<tech_email>\S+)"
| eval is_reg=if(match(_raw,"Registering technician login for"),1,0)
| eval is_anon=if(match(_raw,"\[New Anon\]") OR match(_raw,"Configuration save requested \(Forged Attacker"),1,0)
| bin _time span=10m
| stats sum(is_reg) as registrations sum(is_anon) as anon_markers values(tech_email) as technician_emails values(host) as simplehelp_host by _time
| where registrations>0 AND anon_markers>0
| eval rule="CVE-2026-48558 SimpleHelp OIDC forged-token technician registration"
| table _time simplehelp_host technician_emails registrations anon_markers rule

Microsoft KQL

// SimpleHelp server.log ingested via custom table SimpleHelpServer_CL
SimpleHelpServer_CL
| where TimeGenerated > ago(24h)
| where RawData has "Registering technician login for"
    or RawData has "[New Anon]"
    or RawData has "Configuration save requested (Forged Attacker"
| extend TechEmail = extract(@"Registering technician login for (\S+)", 1, RawData)
| extend IsReg = iff(RawData has "Registering technician login for", 1, 0)
| extend IsAnon = iff(RawData has "[New Anon]" or RawData has "Configuration save requested (Forged Attacker", 1, 0)
| summarize Registrations = sum(IsReg), AnonMarkers = sum(IsAnon), Technicians = make_set(TechEmail) by bin(TimeGenerated, 10m), Computer
| where Registrations > 0 and AnonMarkers > 0
| project TimeGenerated, Computer, Technicians, Registrations, AnonMarkers

Sigma

title: SimpleHelp Rogue Technician Registration via Forged OIDC Token (CVE-2026-48558)
id: 7c1a9f02-3d4e-4a51-9b2c-0820e1a55101
status: experimental
description: Detects creation of a group-authenticated SimpleHelp Technician account via a forged/unsigned OIDC identity token (CWE-347 signature-verification bypass), as logged in server.log.
references:
    - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-48558/
    - https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/16
tags:
    - attack.initial_access
    - attack.t1190
    - attack.credential_access
    - attack.t1606.002
    - attack.persistence
    - attack.t1136.001
    - cve.2026.48558
logsource:
    product: simplehelp
    service: server
detection:
    selection_reg:
        message|contains: 'Registering technician login for'
    selection_anon:
        message|contains:
            - '[New Anon]'
            - 'Configuration save requested (Forged Attacker'
    condition: selection_reg and selection_anon
falsepositives:
    - Legitimate first-time enrollment of an OIDC group-authenticated technician during onboarding
level: critical

Known false positives:

• Legitimate onboarding of a new OIDC group-authenticated technician
• Initial OIDC integration testing by administrators generating '[New Anon]' entries

Tuning notes: Baseline known technician onboarding windows and allow-list provisioning admin source IPs. Correlate technician_emails against the authorized roster (Administration -> Technicians -> Show Group Authenticated Users); alert only on emails with no provisioning record. Tighten the bin window if onboarding bursts cause noise.

• 🔒 OIDC alg=none Identity Token POSTed to Callback from Non-Browser (CVE-2026-48558) — Exploitation · unlock with TL Creds
• 🔒 Rogue OIDC Technician Account Creation and Device Registration (CVE-2026-48558) — Post-Exploitation · unlock with TL Creds
• 🔒 Managed-Endpoint Remote Tooling Spawned by SimpleHelp RMM Agent After Bypass (CVE-2026-48558) — C2 / Lateral Movement · unlock with TL Creds
• 🔒 Forged OIDC Token Accepted Without Signature Verification (CVE-2026-48558) — Exploitation · unlock with TL Creds
• 🔒 SimpleHelp Group-Authenticated Technician Self-Enrolls MFA Bypassing Enforcement (CVE-2026-48558) — Post-Exploitation · unlock with TL Creds
• 🔒 SimpleHelp Rogue Technician Lateral Movement and Remote Script Execution (CVE-2026-48558) — C2 / Lateral Movement · unlock with TL Creds
• 🔒 SimpleHelp Technician MFA Self-Enrollment on First Login (CVE-2026-48558) — Post-Exploitation · unlock with TL Creds
• 🔒 SimpleHelp New Technician Remote Tool/Script Execution from Unapproved IP (CVE-2026-48558) — C2 / Lateral Movement · unlock with TL Creds

Indicators of compromise for SimpleHelp OIDC auth bypass

As of 2026-06-16, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-0820.

How SimpleHelp OIDC auth bypass works

It affects SimpleHelp 5.5.15 and earlier plus pre-release 6.0 builds, and is fixed in v5.5.16 and v6.0 RC 2.

SimpleHelp is a widely deployed remote support / remote monitoring and management (RMM) platform. CVE-2026-48558, discovered by Horizon3.ai via its autonomous AI vulnerability-research initiative "Sua Sponte," is an OpenID Connect (OIDC) authentication bypass that grants an unauthenticated remote attacker a fully authenticated Technician session.

The root cause is improper verification of a cryptographic signature (CWE-347): during the OIDC login flow the SimpleHelp server accepts the submitted identity token without validating the identity provider's signature on it. Because the server trusts the token's claims rather than the signature, an attacker can craft a forged token containing arbitrary identity claims (e.g., an email/subject of their choosing) and submit it to obtain a Technician session without any valid credentials. Horizon3.ai noted the deployments at risk are those integrated with an external IdP such as Azure Active Directory / Entra ID.

Exploitation requires a specific—but common—server configuration: (1) OIDC authentication enabled with at least one configured provider, (2) at least one TechnicianGroup associated with that OIDC provider, and (3) the "Allow group authenticated logins" option enabled on the TechnicianGroup. The attacker also needs network reachability to the SimpleHelp server and a source IP that satisfies any configured Technician login IP restrictions. When these conditions hold, the forged token causes the server to register a brand-new Technician login ("group authenticated" / "[New Anon]") on the fly.

A second, compounding weakness is MFA self-enrollment: SimpleHelp lets a technician self-register their MFA device on first login. Even where MFA is enforced on the TechnicianGroup, the attacker—logging in as a freshly created account for the first time—simply enrolls their own MFA device, fully bypassing the multi-factor control. The net result is an unauthenticated path to a Technician account with the ability to remotely access managed endpoints, push and execute scripts/tools, and perform administrative actions across the managed estate.

Impact is amplified by RMM blast radius: a single compromised SimpleHelp server can reach every endpoint it manages, making this a high-value supply-chain-style foothold. SimpleHelp stated it was not aware of malicious exploitation at patch time, but prior SimpleHelp vulnerabilities disclosed in January 2025 were subsequently weaponized for ransomware delivery, so defenders should treat exposed, unpatched, OIDC-configured servers as high risk.

Exposure is significant: Horizon3.ai observed internet-facing SimpleHelp instances grow roughly fourfold—from about 3,400 in early 2025 to nearly 14,000 by June 2026—with about 7.2% of sampled servers using the vulnerable OIDC authentication method. Forensic detection focuses on the SimpleHelp server logs (/opt/SimpleHelp/logs/server.log), where exploitation leaves "Registering technician login for" entries and "Configuration save requested" entries bearing "[New Anon]" / forged-attacker markers, and on the Administration UI's "Show Group Authenticated Users" technician review. Remediation is to upgrade to v5.5.16 or v6.0 RC 2; interim mitigation is to restrict technician authentication to approved source IPs (Administration → Login Security) or disconnect affected servers from the network.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery; T1087 Account Discovery

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Defense Evasion

T1078 Valid Accounts

Persistence

T1078 Valid Accounts; T1098 Account Manipulation; T1136 Create Account

Command and Control

T1219 Remote Access Tools

Impact

T1486 Data Encrypted for Impact

lateral-movement

T1550 Use Alternate Authentication Material

Credential Access

T1556 Modify Authentication Process; T1606 Forge Web Credentials

Remediation for SimpleHelp OIDC auth bypass

Patches

• SimpleHelp 5.5.16 (stable)
• SimpleHelp 6.0 RC 2
• SimpleSetup update channel: https://simple-help.com/releases/5.5.16_202605

Immediate actions

• Upgrade SimpleHelp to v5.5.16 (5.5.x branch) or v6.0 RC 2 immediately
• If immediate patching is impossible, disconnect affected SimpleHelp servers from the network until updated
• Restrict Technician authentication to approved source IPs via Administration -> Login Security
• Audit the technician roster via Administration -> Technicians -> Gear Icon -> 'Show Group Authenticated Users' and remove any unrecognized accounts

Workarounds

• Disable 'Allow group authenticated logins' on OIDC-associated TechnicianGroups where feasible
• Restrict OIDC/technician login to trusted source IP ranges
• Follow all hardening steps in the SimpleHelp security guide to raise exploitation difficulty pending upgrade

Longer-term hardening

• Review and minimize use of 'Allow group authenticated logins' on OIDC-linked TechnicianGroups
• Enforce IP allow-listing and network segmentation for all RMM management consoles
• Centralize SimpleHelp server logs into a SIEM and alert on new technician registrations and configuration-save events
• Periodically re-baseline the technician account list against authorized provisioning records

Affected and fixed versions

• SimpleHelp — SimpleHelp Remote Support / RMM
  Vulnerable versions: <= 5.5.15; 6.0 pre-release (prior to RC 2)
  Fixed in: 5.5.16; 6.0 RC 2

Timeline of SimpleHelp OIDC auth bypass

• 2025-01-01 Horizon3.ai baseline: roughly 3,400 internet-facing locked-ioc-15 instances observed in early 2025.
• 2025-01-01 Earlier locked-ioc-15 vulnerabilities disclosed in January 2025 were subsequently exploited in ransomware delivery campaigns, establishing the platform as a proven ransomware entry point.
• 2026-05-21 Horizon3.ai discovers the OIDC authentication bypass via its autonomous AI research initiative 'Sua Sponte'; CVE-2026-48558 assigned.
• 2026-05-22 Vulnerability reported to locked-ioc-15 by Horizon3.ai under coordinated disclosure.
• 2026-05-26 locked-ioc-15 releases fixed builds v5.5.16 and v6.0 RC 2 and publishes the 2026-05 security update advisory (without full technical details).
• 2026-06-09 Patch availability further reported in press coverage of the disclosure.
• 2026-06-12 Horizon3.ai publishes full technical write-up and IOC guidance; NVD publishes CVE-2026-48558 (CVSS 3.1 10.0 / CVSS 4.0 9.5); a Rapid Response exploitation test is added.
• 2026-06-13 Press reports nearly 14,000 internet-exposed locked-ioc-15 servers (~4x growth since early 2025), with ~7.2% using the vulnerable OIDC authentication method.
• 2026-06-15 NVD record for CVE-2026-48558 last modified.
• 2026-06-16 Help Net Security reporting; vendor states no known malicious exploitation at patch time.

Sources cited for SimpleHelp OIDC auth bypass

• NVD - CVE-2026-48558 NVD (NIST) · Advisory · 2026-06-12
• CVE-2026-48558: SimpleHelp OIDC Auth Bypass horizon3.ai · Research · 2026-06-12
• CVE-2026-48558: SimpleHelp Auth Bypass IOCs horizon3.ai · Research · 2026-06-12
• SimpleHelp Security Update 2026-05 simple-help.com · Vendor report · 2026-05-26
• SimpleHelp Release News simple-help.com · Vendor report · 2026-05-26
• SimpleHelp RMM authentication bypass flaw (CVE-2026-48558) Help Net Security · News · 2026-06-16
• Nearly 14,000 SimpleHelp Servers Exposed Amid Critical Authentication Bypass Disclosure cybersecuritynews.com · News · 2026-06-13

Threats related to SimpleHelp OIDC auth bypass

• SimpleHelp Authentication Bypass via Forged OIDC Tokens (CVE-2026-48558) Actively Exploited, Added to CISA KEV
• CVE-2026-52824: Kimai Docker Image Hardcoded APP_SECRET Enables Account Takeover
• CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass
• ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372)
• CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)