# SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass

> CVE-2026-48558 is a critical (CVSS 10.0) authentication bypass in SimpleHelp's OpenID Connect (OIDC) login flow: identity tokens are accepted without verifying their cryptographic signature (CWE-347), letting an unauthenticated remote attacker forge a token with arbitrary identity claims to create and log in as a Technician account, self-enroll their own MFA device on first login, and gain full remote access to managed endpoints. It affects SimpleHelp 5.5.15 and earlier plus pre-release 6.0 builds, and is fixed in v5.5.16 and v6.0 RC 2.

- **Published:** 2026-06-16T00:00:00Z
- **Last reviewed:** 2026-06-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0820
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-simplehelp-oidc-auth-bypass-tl-2026-0820.webp?v=8b3a43e0 (Threadlinqs threat intel: CVE-2026-48558 SimpleHelp Forged Token: Detection & IOCs (TL-2026-0820) — Critical severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0820
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 15
- **CVEs:** CVE-2026-48558

## Description

SimpleHelp is a widely deployed remote support / remote monitoring and management (RMM) platform. CVE-2026-48558, discovered by Horizon3.ai via its autonomous AI vulnerability-research initiative "Sua Sponte," is an OpenID Connect (OIDC) authentication bypass that grants an unauthenticated remote attacker a fully authenticated Technician session.

The root cause is improper verification of a cryptographic signature (CWE-347): during the OIDC login flow the SimpleHelp server accepts the submitted identity token without validating the identity provider's signature on it. Because the server trusts the token's claims rather than the signature, an attacker can craft a forged token containing arbitrary identity claims (e.g., an email/subject of their choosing) and submit it to obtain a Technician session without any valid credentials. Horizon3.ai noted the deployments at risk are those integrated with an external IdP such as Azure Active Directory / Entra ID.

Exploitation requires a specific—but common—server configuration: (1) OIDC authentication enabled with at least one configured provider, (2) at least one TechnicianGroup associated with that OIDC provider, and (3) the "Allow group authenticated logins" option enabled on the TechnicianGroup. The attacker also needs network reachability to the SimpleHelp server and a source IP that satisfies any configured Technician login IP restrictions. When these conditions hold, the forged token causes the server to register a brand-new Technician login ("group authenticated" / "[New Anon]") on the fly.

A second, compounding weakness is MFA self-enrollment: SimpleHelp lets a technician self-register their MFA device on first login. Even where MFA is enforced on the TechnicianGroup, the attacker—logging in as a freshly created account for the first time—simply enrolls their own MFA device, fully bypassing the multi-factor control. The net result is an unauthenticated path to a Technician account with the ability to remotely access managed endpoints, push and execute scripts/tools, and perform administrative actions across the managed estate.

Impact is amplified by RMM blast radius: a single compromised SimpleHelp server can reach every endpoint it manages, making this a high-value supply-chain-style foothold. SimpleHelp stated it was not aware of malicious exploitation at patch time, but prior SimpleHelp vulnerabilities disclosed in January 2025 were subsequently weaponized for ransomware delivery, so defenders should treat exposed, unpatched, OIDC-configured servers as high risk.

Exposure is significant: Horizon3.ai observed internet-facing SimpleHelp instances grow roughly fourfold—from about 3,400 in early 2025 to nearly 14,000 by June 2026—with about 7.2% of sampled servers using the vulnerable OIDC authentication method. Forensic detection focuses on the SimpleHelp server logs (/opt/SimpleHelp/logs/server.log), where exploitation leaves "Registering technician login for" entries and "Configuration save requested" entries bearing "[New Anon]" / forged-attacker markers, and on the Administration UI's "Show Group Authenticated Users" technician review. Remediation is to upgrade to v5.5.16 or v6.0 RC 2; interim mitigation is to restrict technician authentication to approved source IPs (Administration → Login Security) or disconnect affected servers from the network.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1606 Forge Web Credentials
- T1556 Modify Authentication Process
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1136 Create Account
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1219 Remote Access Tools
- T1486 Data Encrypted for Impact

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SimpleHelp Rogue Technician Registration via Forged OIDC Token (CVE-2026-48558) — Exploitation** (`TL-2026-0820-SPL-001`)

Detects the core CVE-2026-48558 exploitation primitive in SimpleHelp server.log: a forged/unsigned OIDC identity token is accepted without signature verification (CWE-347), causing the server to register a new 'group authenticated' Technician login. Fires on 'Registering technician login for' paired with the '[New Anon]' / 'Configuration save requested (Forged Attacker' markers that accompany on-the-fly anonymous technician creation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1606.002, T1136.001
- **Data sources:** simplehelp:server, /opt/SimpleHelp/logs/server.log, SimpleHelpServer_CL
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=rmm sourcetype="simplehelp:server" source="/opt/SimpleHelp/logs/server.log" ("Registering technician login for" OR "[New Anon]" OR "Configuration save requested (Forged Attacker")
| rex field=_raw "Registering technician login for (?<tech_email>\S+)"
| eval is_reg=if(match(_raw,"Registering technician login for"),1,0)
| eval is_anon=if(match(_raw,"\[New Anon\]") OR match(_raw,"Configuration save requested \(Forged Attacker"),1,0)
| bin _time span=10m
| stats sum(is_reg) as registrations sum(is_anon) as anon_markers values(tech_email) as technician_emails values(host) as simplehelp_host by _time
| where registrations>0 AND anon_markers>0
| eval rule="CVE-2026-48558 SimpleHelp OIDC forged-token technician registration"
| table _time simplehelp_host technician_emails registrations anon_markers rule
```

### Microsoft KQL

```kql
// SimpleHelp server.log ingested via custom table SimpleHelpServer_CL
SimpleHelpServer_CL
| where TimeGenerated > ago(24h)
| where RawData has "Registering technician login for"
    or RawData has "[New Anon]"
    or RawData has "Configuration save requested (Forged Attacker"
| extend TechEmail = extract(@"Registering technician login for (\S+)", 1, RawData)
| extend IsReg = iff(RawData has "Registering technician login for", 1, 0)
| extend IsAnon = iff(RawData has "[New Anon]" or RawData has "Configuration save requested (Forged Attacker", 1, 0)
| summarize Registrations = sum(IsReg), AnonMarkers = sum(IsAnon), Technicians = make_set(TechEmail) by bin(TimeGenerated, 10m), Computer
| where Registrations > 0 and AnonMarkers > 0
| project TimeGenerated, Computer, Technicians, Registrations, AnonMarkers
```

### Sigma

```yaml
title: SimpleHelp Rogue Technician Registration via Forged OIDC Token (CVE-2026-48558)
id: 7c1a9f02-3d4e-4a51-9b2c-0820e1a55101
status: experimental
description: Detects creation of a group-authenticated SimpleHelp Technician account via a forged/unsigned OIDC identity token (CWE-347 signature-verification bypass), as logged in server.log.
references:
    - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-48558/
    - https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/16
tags:
    - attack.initial_access
    - attack.t1190
    - attack.credential_access
    - attack.t1606.002
    - attack.persistence
    - attack.t1136.001
    - cve.2026.48558
logsource:
    product: simplehelp
    service: server
detection:
    selection_reg:
        message|contains: 'Registering technician login for'
    selection_anon:
        message|contains:
            - '[New Anon]'
            - 'Configuration save requested (Forged Attacker'
    condition: selection_reg and selection_anon
falsepositives:
    - Legitimate first-time enrollment of an OIDC group-authenticated technician during onboarding
level: critical
```

**Known false positives:**

- Legitimate onboarding of a new OIDC group-authenticated technician
- Initial OIDC integration testing by administrators generating '[New Anon]' entries

**Tuning notes:** Baseline known technician onboarding windows and allow-list provisioning admin source IPs. Correlate technician_emails against the authorized roster (Administration -> Technicians -> Show Group Authenticated Users); alert only on emails with no provisioning record. Tighten the bin window if onboarding bursts cause noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- OIDC alg=none Identity Token POSTed to Callback from Non-Browser (CVE-2026-48558) — Exploitation (locked: unlock with TL Creds)
- Rogue OIDC Technician Account Creation and Device Registration (CVE-2026-48558) — Post-Exploitation (locked: unlock with TL Creds)
- Managed-Endpoint Remote Tooling Spawned by SimpleHelp RMM Agent After Bypass (CVE-2026-48558) — C2 / Lateral Movement (locked: unlock with TL Creds)
- Forged OIDC Token Accepted Without Signature Verification (CVE-2026-48558) — Exploitation (locked: unlock with TL Creds)
- SimpleHelp Group-Authenticated Technician Self-Enrolls MFA Bypassing Enforcement (CVE-2026-48558) — Post-Exploitation (locked: unlock with TL Creds)
- SimpleHelp Rogue Technician Lateral Movement and Remote Script Execution (CVE-2026-48558) — C2 / Lateral Movement (locked: unlock with TL Creds)
- SimpleHelp Technician MFA Self-Enrollment on First Login (CVE-2026-48558) — Post-Exploitation (locked: unlock with TL Creds)
- SimpleHelp New Technician Remote Tool/Script Execution from Unapproved IP (CVE-2026-48558) — C2 / Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CVE-2026-48558: SimpleHelp OIDC Auth Bypass](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-48558/)
- [CVE-2026-48558: SimpleHelp Auth Bypass IOCs](https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/)
- [NVD - CVE-2026-48558](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-48558)
- [SimpleHelp Security Update 2026-05](https://simple-help.com/security/simplehelp-security-update-2026-05)
- [SimpleHelp Release News](https://simple-help.com/release-news)
- [SimpleHelp RMM authentication bypass flaw (CVE-2026-48558)](https://www.helpnetsecurity.com/2026/06/16/simplehelp-rmm-cve-2026-48558/)
- [Nearly 14,000 SimpleHelp Servers Exposed Amid Critical Authentication Bypass Disclosure](https://cybersecuritynews.com/simplehelp-servers-exposed-authentication-bypass-disclosure/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0820