SimpleHelp Authentication Bypass via Forged OIDC Tokens (CVE-2026-48558) Actively Exploited, Added to CISA KEV
SimpleHelp Authentication Bypass via Forged OIDC Tokens (TL-2026-1122), also tracked as TaskWeaver/Djinn Stealer Campaign, is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-05 and last reviewed 2026-07-11. It has no confirmed attribution, affects SimpleHelp SimpleHelp Remote Support / RMM Software, references 1 CVE (CVE-2026-48558), maps to 48 MITRE ATT&CK techniques (T1005, T1016, T1020), and is covered by 9 detection rules and 46 indicators of compromise.
Key facts for TL-2026-1122
- Threat ID
- TL-2026-1122
- Also known as
- TaskWeaver/Djinn Stealer Campaign
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-05
- Last reviewed
- 2026-07-11
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, managedserviceproviders, softwaredevelopment, cross-sector
- Target regions
- Global, North America
- Detection rules
- 9
- Indicators of compromise
- 46
- Updates
- 2026-07-11 · 5 updates · revalidated 5× · latest source
Malware and tooling in SimpleHelp Authentication Bypass via Forged OIDC Tokens
Malware and tooling: Djinn Stealer, TaskWeaver, Claude, Cline, Codex, Docker, Gemini, Helm, Kilo, OpenCode, SimpleHelp
CVE-2026-48558 is a maximum-severity (CVSS 10.0) authentication bypass in SimpleHelp remote support/RMM software configured with OpenID Connect (OIDC), caused by failure to verify the cryptographic signature of identity tokens (CWE-347). Unauthenticated attackers can submit a forged identity token with arbitrary claims to obtain a fully authenticated Technician session, in some configurations bypassing MFA entirely, and are actively using this access to deploy the novel TaskWeaver Node.js loader and Djinn Stealer infostealer against MSP-managed environments.
How SimpleHelp Authentication Bypass via Forged OIDC Tokens works
CVE-2026-48558 affects SimpleHelp deployments that have at least one OIDC identity provider configured, a Technician Group associated with that provider, and the "Allow group authenticated logins" setting enabled (including both generic OIDC and Azure AD OIDC configurations). In this configuration, SimpleHelp accepts identity tokens submitted during the OIDC login flow without verifying their cryptographic signature. A remote, unauthenticated attacker can therefore craft a forged identity/JWT-style token containing arbitrary identity claims and present it to the login endpoint to create and authenticate as a new, fully privileged "Technician" account. Because SimpleHelp allows technicians to self-register their own MFA method on first login, the forged-account path can also result in a full bypass of any configured multi-factor authentication.
Horizon3.ai's Zach Hanley, working through the firm's autonomous "Sua Sponte" AI-driven vulnerability research initiative, privately reported the flaw to SimpleHelp on 2026-05-22. SimpleHelp silently shipped fixed builds (5.5.16 and 6.0 RC2) around 2026-05-26, and Horizon3.ai publicly disclosed full technical detail and indicators of compromise on 2026-06-12. Internet-wide scanning at disclosure time found roughly 14,000 SimpleHelp servers exposed to the internet, of which approximately 7.2% (roughly 1,000 servers) were configured in the vulnerable OIDC/group-authentication mode.
On 2026-06-29, BlackPoint Cyber's Adversary Pursuit Group published "A Djinn in the Machine," documenting a real-world intrusion in which an attacker exploited CVE-2026-48558 against an internet-facing SimpleHelp server to obtain a forged Technician session, then abused the RMM's own remote file-transfer and remote-execution capabilities to push a malicious payload to managed endpoints. The payload was a 1.08 MB, single-line, heavily obfuscated Node.js file named "jquery.js" (to masquerade as the legitimate jQuery library), staged on a temporary Cloudflare Tunnel (trycloudflare.com) URL and executed via node.exe. This loader, dubbed TaskWeaver, fingerprints the host and establishes an encrypted, reusable command channel to a remote server at a.dev-tunnels[.]com, allowing the operator to push arbitrary follow-on JavaScript modules without modifying the loader itself.
TaskWeaver's primary observed payload is Djinn Stealer, a previously undocumented, cross-platform (Windows, macOS, Linux) information stealer that reuses TaskWeaver's obfuscation framework and embeds the identical RSA-2048 public key, tying the two families to the same operator. Djinn Stealer harvests cloud-provider credentials (AWS, Azure, Google Cloud, Oracle, Okta, Cloudflare), developer/DevOps credentials (GitHub, Git configuration, SSH private keys, Docker, Helm, npm, pip/PyPI, Cargo, Maven and other package-registry tokens), AI coding-assistant credentials (Claude, Gemini, Codex, Cline), cryptocurrency wallets (Bitcoin, Ethereum, Monero, Exodus, Atomic Wallet), browser-stored data, shell history, and PGP keys. On Linux hosts it additionally reads /proc/<pid>/cmdline and /proc/<pid>/environ to recover secrets embedded in running-process arguments and environment variables. Collected data is packed into a TAR archive, compressed with GZIP, and encrypted with AES-256-GCM using a key itself protected by an embedded RSA-2048 public key, before being exfiltrated to an attacker-controlled server at 96.126.130.126 on TCP port 58942.
CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-29 based on confirmed in-the-wild exploitation, triggering a Binding Operational Directive (BOD) 26-04 remediation deadline of 2026-07-02 for U.S. federal civilian agencies. Because SimpleHelp is widely deployed by managed service providers (MSPs) and IT service organizations to centrally administer client endpoints, a single compromised SimpleHelp instance can cascade into a multi-tenant supply-chain compromise, giving an attacker trusted administrative reach into every downstream organization managed through that instance.
MITRE ATT&CK techniques used in TL-2026-1122
Collection
T1005 Data from Local System; T1074 Data Staged; T1119 Automated Collection; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Credential Access
T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1606 Forge Web Credentials
Execution
T1059 Command and Scripting Interpreter; T1072 Software Deployment Tools; T1569 System Services
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1568 Dynamic Resolution; T1572 Protocol Tunneling; T1573 Encrypted Channel
Persistence
T1098 Account Manipulation; T1136 Create Account
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Impact
lateral-movement
T1550 Use Alternate Authentication Material
defense-impairment
T1556 Modify Authentication Process
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Reconnaissance
Affected products and versions in SimpleHelp Authentication Bypass via Forged OIDC Tokens
- SimpleHelp — SimpleHelp Remote Support / RMM Software
Vulnerable versions: 5.5.15 and earlier 5.5.x releases; 6.0 pre-release builds prior to RC2
Fixed in: 5.5.16; 6.0 RC2
Remediation for SimpleHelp Authentication Bypass via Forged OIDC Tokens
Patches
- Upgrade to SimpleHelp 5.5.16 (5.5.x branch)
- Upgrade to SimpleHelp 6.0 RC2 or later (6.0 branch)
Immediate actions
- Apply SimpleHelp 5.5.16 (5.5.x branch) or 6.0 RC2 (6.0 branch) immediately; CISA BOD 26-04 set a 2026-07-02 remediation deadline for federal agencies
- In the SimpleHelp admin console, navigate to Administration -> Technicians -> Gear Icon -> 'Show Group Authenticated Users' and review for any unfamiliar OIDC technician names or email addresses
- Audit server logs at /opt/SimpleHelp/logs/server.log (or the dated /opt/SimpleHelp/logs/<YYYYMMDD-HHMMSS>/server.log subdirectories) for unrecognized technician logins or logins from unexpected source IPs
- If immediate patching is not possible, disable OIDC/'Allow group authenticated logins' or disconnect the internet-facing SimpleHelp server from the network
- Hunt for node.exe processes executing a file named jquery.js, and block outbound connections to a.dev-tunnels.com and 96.126.130.126:58942
Workarounds
- Disable OIDC/SSO authentication providers on the SimpleHelp server until patched
- Disconnect internet-facing SimpleHelp servers from the network if patching cannot occur immediately
- Force re-authentication and rotate all Technician account credentials after patching or remediation
Longer-term hardening
- Restrict SimpleHelp Technician login to an IP allow-list
- Deploy EDR/behavioral detection on RMM and remote-support hosts to flag anomalous Node.js child-process execution and unsigned script execution
- Segment RMM management infrastructure from general corporate and client networks to limit supply-chain blast radius
- Require out-of-band, administrator-provisioned MFA that cannot be self-registered by a newly created account on first login
- Establish continuous external attack-surface monitoring for internet-facing RMM/remote-support servers
CVEs associated with SimpleHelp Authentication Bypass via Forged OIDC Tokens
Weaknesses (CWE) in SimpleHelp Authentication Bypass via Forged OIDC Tokens
CWE-347, CWE-287, CWE-290, CWE-306
Timeline of SimpleHelp Authentication Bypass via Forged OIDC Tokens
- Horizon3.ai identifies CVE-2026-48558 and validates its exploitability against SimpleHelp OIDC/Azure AD OIDC login flows in customer environments.
- Horizon3.ai's Zach Hanley, via the firm's Sua Sponte autonomous research initiative, privately reports the OIDC signature-verification flaw to SimpleHelp.
- SimpleHelp quietly ships fixed builds 5.5.16 and 6.0 RC2 without an associated public CVE identifier at time of release.
- Horizon3.ai discovers SimpleHelp had already shipped a fix (5.5.16 / 6.0 RC2, Security Update 2026-05) without notifying the researchers, ahead of the researchers' planned coordinated-disclosure date.
- Horizon3.ai publicly discloses CVE-2026-48558 with full technical detail and initial indicators of compromise; PoC exploit code is published on GitHub.
- Follow-on reporting quantifies exposure: roughly 14,000 SimpleHelp servers are internet-facing, with approximately 7.2% (~1,000 servers) configured in the vulnerable OIDC/group-authentication mode.
- CISA adds CVE-2026-48558 to the Known Exploited Vulnerabilities (KEV) catalog, triggering BOD 26-04 remediation requirements for federal civilian agencies.
- BlackPoint Cyber's Adversary Pursuit Group publishes 'A Djinn in the Machine,' documenting a real intrusion where an attacker used CVE-2026-48558 to obtain a forged Technician session and deploy the TaskWeaver loader on an internet-facing SimpleHelp server.
- Arctic Wolf and SOCRadar publish independent guidance and analysis on CVE-2026-48558 exploitation, credential-theft impact, and MSP remediation recommendations.
- Multiple outlets (Help Net Security, BleepingComputer, The Hacker News, Arctic Wolf) report that the TaskWeaver Node.js loader delivers a previously undocumented cross-platform infostealer named Djinn Stealer.
- Cyber Security News publishes summary coverage confirming active in-the-wild exploitation and CISA KEV listing.
- BOD 26-04 remediation deadline passes for U.S. federal civilian agencies to apply mitigations for CVE-2026-48558.
Update history for TL-2026-1122
- 2026-07-11 — CISA KEV Addition: SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) Exploited to Deploy TaskWeaver Loader and Djinn Stealer in MSP Supply-Chain Compromise: What changed No escalation — severity CRITICAL, exploitability ACTIVE, status ACTIVE, CVSS 10.0, and attribution (Unknown/LOW confidence) are all unchanged. New MITRE (2) Two additional ATT&CK techniques not previously recorded: T1111 (Mult
- 2026-07-11 — Djinn Stealer Targets Cloud and AI Agent Credentials via SimpleHelp RMM Exploitation (CVE-2026-48558): What changed No severity/exploitability/status escalation — both records already CRITICAL/ACTIVE/ACTIVE at CVSS 10.0. The update is additive: Djinn Stealer's AI-credential targeting is now known to extend beyond Claude/Gemini/Codex/Cline to
- 2026-07-10 — CVE-2026-48558: SimpleHelp OIDC Authentication Bypass Exploited to Deploy TaskWeaver Loader and Djinn Stealer: What changed No severity/exploitability/status escalation — the newer report corroborates the existing CRITICAL/ACTIVE/CVSS 10.0 record without downgrade or upgrade. New indicators (2) 1 new file artifact (user-dirs.txt, a Djinn Stealer use
- 2026-07-10 — SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) Actively Exploited to Deploy TaskWeaver Loader and Djinn Stealer, Added to CISA KEV: What changed No field escalations. Severity/CVSS in the newer report (HIGH / 9.5 CVSS v4.0) are lower than the existing record (CRITICAL / 10.0 CVSS v3.1) and are not applied, per escalation-only policy. New indicators (4) 4 new indicators:
- 2026-07-10 — CVE-2026-48558: SimpleHelp RMM OIDC Authentication Bypass Exploited to Deploy TaskWeaver Loader and Djinn Stealer: What changed No severity/exploitability/status escalation — already CRITICAL/ACTIVE/ACTIVE with CVSS 10.0 in both reports. New report adds a second root-cause CWE (CWE-287) and clarifies that SimpleHelp's fix predated and was discovered ind
Sources cited for SimpleHelp Authentication Bypass via Forged OIDC Tokens
- SimpleHelp Authentication Bypass Vulnerability Actively Exploited
- CVE-2026-48558: SimpleHelp Auth Bypass IOCs
- CVE-2026-48558: SimpleHelp OIDC Auth Bypass
- CVE-2026-48558 | Arctic Wolf
- SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)
- CVE-2026-48558: SimpleHelp OIDC Auth Bypass Used to Deploy Infostealer Payloads
- CVE-2026-48558: SimpleHelp RMM Authentication Bypass — Unsigned OIDC Tokens Enable Unauthenticated Technician Access, MSP Supply Chain Attack (CISA KEV, CVSS 10.0)
- A Djinn in the Machine: TaskWeaver's Node.js Intrusion Chain
- CVE-2026-48558 Detail
- CISA Adds One Known Exploited Vulnerability to Catalog
- CVE-2026-48558
- Critical SimpleHelp flaw exploited to deploy new stealer malware
- Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
- Djinn Stealer Targets Cloud and AI Credentials
- U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog
Threats related to SimpleHelp Authentication Bypass via Forged OIDC Tokens
- SimpleHelp RMM OIDC Authentication Bypass (CVE-2026-48558) — Unauthenticated Forged-Token Technician Account Creation and MFA Bypass
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)
- Compromised Packagist PHP Packages Weaponize GitHub Actions Runners to Target cPanel/WHM Servers (CVE-2026-41940)
- Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)
- iAuthFlow V2 Phishing Toolkit Enrolls Attacker-Controlled Passkeys That Survive Password Resets
- N-able N-central Authentication Bypass (CVE-2026-18577) Actively Exploited for Admin Takeover
Detection coverage for TL-2026-1122
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1122 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.