SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass

SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) (TL-2026-0820), also tracked as SimpleHelp OIDC Auth Bypass, is a critical-severity software vulnerability scored CVSS 10, first published 2026-06-16. It has no confirmed attribution, affects SimpleHelp SimpleHelp Remote Support / RMM, references 1 CVE (CVE-2026-48558), maps to 14 MITRE ATT&CK techniques (T1018, T1021, T1059), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0820

Threat ID
TL-2026-0820
Also known as
SimpleHelp OIDC Auth Bypass, SimpleHelp Forged-Token Technician Bypass
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-06-16
Last reviewed
2026-06-16
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
managed service providers, it services, technology
Target regions
Global
Detection rules
9
Indicators of compromise
15

CVE-2026-48558 is a critical (CVSS 10.0) authentication bypass in SimpleHelp's OpenID Connect (OIDC) login flow: identity tokens are accepted without verifying their cryptographic signature (CWE-347), letting an unauthenticated remote attacker forge a token with arbitrary identity claims to create and log in as a Technician account, self-enroll their own MFA device on first login, and gain full remote access to managed endpoints. It affects SimpleHelp 5.5.15 and earlier plus pre-release 6.0 builds, and is fixed in v5.5.16 and v6.0 RC 2.

How SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) works

SimpleHelp is a widely deployed remote support / remote monitoring and management (RMM) platform. CVE-2026-48558, discovered by Horizon3.ai via its autonomous AI vulnerability-research initiative "Sua Sponte," is an OpenID Connect (OIDC) authentication bypass that grants an unauthenticated remote attacker a fully authenticated Technician session.

The root cause is improper verification of a cryptographic signature (CWE-347): during the OIDC login flow the SimpleHelp server accepts the submitted identity token without validating the identity provider's signature on it. Because the server trusts the token's claims rather than the signature, an attacker can craft a forged token containing arbitrary identity claims (e.g., an email/subject of their choosing) and submit it to obtain a Technician session without any valid credentials. Horizon3.ai noted the deployments at risk are those integrated with an external IdP such as Azure Active Directory / Entra ID.

Exploitation requires a specific—but common—server configuration: (1) OIDC authentication enabled with at least one configured provider, (2) at least one TechnicianGroup associated with that OIDC provider, and (3) the "Allow group authenticated logins" option enabled on the TechnicianGroup. The attacker also needs network reachability to the SimpleHelp server and a source IP that satisfies any configured Technician login IP restrictions. When these conditions hold, the forged token causes the server to register a brand-new Technician login ("group authenticated" / "[New Anon]") on the fly.

A second, compounding weakness is MFA self-enrollment: SimpleHelp lets a technician self-register their MFA device on first login. Even where MFA is enforced on the TechnicianGroup, the attacker—logging in as a freshly created account for the first time—simply enrolls their own MFA device, fully bypassing the multi-factor control. The net result is an unauthenticated path to a Technician account with the ability to remotely access managed endpoints, push and execute scripts/tools, and perform administrative actions across the managed estate.

Impact is amplified by RMM blast radius: a single compromised SimpleHelp server can reach every endpoint it manages, making this a high-value supply-chain-style foothold. SimpleHelp stated it was not aware of malicious exploitation at patch time, but prior SimpleHelp vulnerabilities disclosed in January 2025 were subsequently weaponized for ransomware delivery, so defenders should treat exposed, unpatched, OIDC-configured servers as high risk.

Exposure is significant: Horizon3.ai observed internet-facing SimpleHelp instances grow roughly fourfold—from about 3,400 in early 2025 to nearly 14,000 by June 2026—with about 7.2% of sampled servers using the vulnerable OIDC authentication method. Forensic detection focuses on the SimpleHelp server logs (/opt/SimpleHelp/logs/server.log), where exploitation leaves "Registering technician login for" entries and "Configuration save requested" entries bearing "[New Anon]" / forged-attacker markers, and on the Administration UI's "Show Group Authenticated Users" technician review. Remediation is to upgrade to v5.5.16 or v6.0 RC 2; interim mitigation is to restrict technician authentication to approved source IPs (Administration → Login Security) or disconnect affected servers from the network.

MITRE ATT&CK techniques used in TL-2026-0820

Discovery

T1018 Remote System Discovery; T1087 Account Discovery

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship

Defense Evasion

T1078 Valid Accounts

Persistence

T1078 Valid Accounts; T1098 Account Manipulation; T1136 Create Account

Command and Control

T1219 Remote Access Tools

Impact

T1486 Data Encrypted for Impact

lateral-movement

T1550 Use Alternate Authentication Material

Credential Access

T1556 Modify Authentication Process; T1606 Forge Web Credentials

Affected products and versions in SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

  • SimpleHelp — SimpleHelp Remote Support / RMM
    Vulnerable versions: <= 5.5.15; 6.0 pre-release (prior to RC 2)
    Fixed in: 5.5.16; 6.0 RC 2

Remediation for SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

Patches

  • SimpleHelp 5.5.16 (stable)
  • SimpleHelp 6.0 RC 2
  • SimpleSetup update channel: https://simple-help.com/releases/5.5.16_202605

Immediate actions

  • Upgrade SimpleHelp to v5.5.16 (5.5.x branch) or v6.0 RC 2 immediately
  • If immediate patching is impossible, disconnect affected SimpleHelp servers from the network until updated
  • Restrict Technician authentication to approved source IPs via Administration -> Login Security
  • Audit the technician roster via Administration -> Technicians -> Gear Icon -> 'Show Group Authenticated Users' and remove any unrecognized accounts

Workarounds

  • Disable 'Allow group authenticated logins' on OIDC-associated TechnicianGroups where feasible
  • Restrict OIDC/technician login to trusted source IP ranges
  • Follow all hardening steps in the SimpleHelp security guide to raise exploitation difficulty pending upgrade

Longer-term hardening

  • Review and minimize use of 'Allow group authenticated logins' on OIDC-linked TechnicianGroups
  • Enforce IP allow-listing and network segmentation for all RMM management consoles
  • Centralize SimpleHelp server logs into a SIEM and alert on new technician registrations and configuration-save events
  • Periodically re-baseline the technician account list against authorized provisioning records

CVEs associated with SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

CVE-2026-48558

Weaknesses (CWE) in SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

CWE-347

Timeline of SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

  • Horizon3.ai baseline: roughly 3,400 internet-facing SimpleHelp instances observed in early 2025.
  • Earlier SimpleHelp vulnerabilities disclosed in January 2025 were subsequently exploited in ransomware delivery campaigns, establishing the platform as a proven ransomware entry point.
  • Horizon3.ai discovers the OIDC authentication bypass via its autonomous AI research initiative 'Sua Sponte'; CVE-2026-48558 assigned.
  • Vulnerability reported to SimpleHelp by Horizon3.ai under coordinated disclosure.
  • SimpleHelp releases fixed builds v5.5.16 and v6.0 RC 2 and publishes the 2026-05 security update advisory (without full technical details).
  • Patch availability further reported in press coverage of the disclosure.
  • Horizon3.ai publishes full technical write-up and IOC guidance; NVD publishes CVE-2026-48558 (CVSS 3.1 10.0 / CVSS 4.0 9.5); a Rapid Response exploitation test is added.
  • Press reports nearly 14,000 internet-exposed SimpleHelp servers (~4x growth since early 2025), with ~7.2% using the vulnerable OIDC authentication method.
  • NVD record for CVE-2026-48558 last modified.
  • Help Net Security reporting; vendor states no known malicious exploitation at patch time.

Sources cited for SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

Threats related to SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558)

Detection coverage for TL-2026-0820

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0820 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats