# SimpleHelp Authentication Bypass via Forged OIDC Tokens (CVE-2026-48558) Actively Exploited, Added to CISA KEV

> CVE-2026-48558 is a maximum-severity (CVSS 10.0) authentication bypass in SimpleHelp remote support/RMM software configured with OpenID Connect (OIDC), caused by failure to verify the cryptographic signature of identity tokens (CWE-347). Unauthenticated attackers can submit a forged identity token with arbitrary claims to obtain a fully authenticated Technician session, in some configurations bypassing MFA entirely, and are actively using this access to deploy the novel TaskWeaver Node.js loader and Djinn Stealer infostealer against MSP-managed environments.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-11T04:05:23.353Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1122
- **ID:** TL-2026-1122
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48558

## Description

CVE-2026-48558 affects SimpleHelp deployments that have at least one OIDC identity provider configured, a Technician Group associated with that provider, and the "Allow group authenticated logins" setting enabled (including both generic OIDC and Azure AD OIDC configurations). In this configuration, SimpleHelp accepts identity tokens submitted during the OIDC login flow without verifying their cryptographic signature. A remote, unauthenticated attacker can therefore craft a forged identity/JWT-style token containing arbitrary identity claims and present it to the login endpoint to create and authenticate as a new, fully privileged "Technician" account. Because SimpleHelp allows technicians to self-register their own MFA method on first login, the forged-account path can also result in a full bypass of any configured multi-factor authentication.

Horizon3.ai's Zach Hanley, working through the firm's autonomous "Sua Sponte" AI-driven vulnerability research initiative, privately reported the flaw to SimpleHelp on 2026-05-22. SimpleHelp silently shipped fixed builds (5.5.16 and 6.0 RC2) around 2026-05-26, and Horizon3.ai publicly disclosed full technical detail and indicators of compromise on 2026-06-12. Internet-wide scanning at disclosure time found roughly 14,000 SimpleHelp servers exposed to the internet, of which approximately 7.2% (roughly 1,000 servers) were configured in the vulnerable OIDC/group-authentication mode.

On 2026-06-29, BlackPoint Cyber's Adversary Pursuit Group published "A Djinn in the Machine," documenting a real-world intrusion in which an attacker exploited CVE-2026-48558 against an internet-facing SimpleHelp server to obtain a forged Technician session, then abused the RMM's own remote file-transfer and remote-execution capabilities to push a malicious payload to managed endpoints. The payload was a 1.08 MB, single-line, heavily obfuscated Node.js file named "jquery.js" (to masquerade as the legitimate jQuery library), staged on a temporary Cloudflare Tunnel (trycloudflare.com) URL and executed via node.exe. This loader, dubbed TaskWeaver, fingerprints the host and establishes an encrypted, reusable command channel to a remote server at a.dev-tunnels[.]com, allowing the operator to push arbitrary follow-on JavaScript modules without modifying the loader itself.

TaskWeaver's primary observed payload is Djinn Stealer, a previously undocumented, cross-platform (Windows, macOS, Linux) information stealer that reuses TaskWeaver's obfuscation framework and embeds the identical RSA-2048 public key, tying the two families to the same operator. Djinn Stealer harvests cloud-provider credentials (AWS, Azure, Google Cloud, Oracle, Okta, Cloudflare), developer/DevOps credentials (GitHub, Git configuration, SSH private keys, Docker, Helm, npm, pip/PyPI, Cargo, Maven and other package-registry tokens), AI coding-assistant credentials (Claude, Gemini, Codex, Cline), cryptocurrency wallets (Bitcoin, Ethereum, Monero, Exodus, Atomic Wallet), browser-stored data, shell history, and PGP keys. On Linux hosts it additionally reads /proc/<pid>/cmdline and /proc/<pid>/environ to recover secrets embedded in running-process arguments and environment variables. Collected data is packed into a TAR archive, compressed with GZIP, and encrypted with AES-256-GCM using a key itself protected by an embedded RSA-2048 public key, before being exfiltrated to an attacker-controlled server at 96.126.130.126 on TCP port 58942.

CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-29 based on confirmed in-the-wild exploitation, triggering a Binding Operational Directive (BOD) 26-04 remediation deadline of 2026-07-02 for U.S. federal civilian agencies. Because SimpleHelp is widely deployed by managed service providers (MSPs) and IT service organizations to centrally administer client endpoints, a single compromised SimpleHelp instance can cascade into a multi-tenant supply-chain compromise, giving an attacker trusted administrative reach into every downstream organization managed through that instance.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1550 Use Alternate Authentication Material
- T1059 Command and Scripting Interpreter
- T1072 Software Deployment Tools
- T1136 Create Account
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1021 Remote Services
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1016 System Network Configuration Discovery
- T1105 Ingress Tool Transfer
- T1074 Data Staged
- T1020 Automated Exfiltration
- T1531 Account Access Removal
- T1119 Automated Collection
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service
- T1556 Modify Authentication Process
- T1070 Indicator Removal
- T1569 System Services
- T1056 Input Capture

## Sources

- [SimpleHelp Authentication Bypass Vulnerability Actively Exploited](https://cybersecuritynews.com/simplehelp-auth-vulnerability-exploited/)
- [CVE-2026-48558: SimpleHelp Auth Bypass IOCs](https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/)
- [CVE-2026-48558: SimpleHelp OIDC Auth Bypass](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-48558/)
- [CVE-2026-48558 | Arctic Wolf](https://arcticwolf.com/resources/blog/cve-2026-48558-critical-authentication-bypass-vulnerability-in-simplehelp-rmm-exploited-for-credential-theft-and-malware-delivery/)
- [SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)](https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/)
- [CVE-2026-48558: SimpleHelp OIDC Auth Bypass Used to Deploy Infostealer Payloads](https://socradar.io/blog/cve-2026-48558-simplehelp-oidc-infostealer/)
- [CVE-2026-48558: SimpleHelp RMM Authentication Bypass — Unsigned OIDC Tokens Enable Unauthenticated Technician Access, MSP Supply Chain Attack (CISA KEV, CVSS 10.0)](https://threat-modeling.com/cve-2026-48558-simplehelp-rmm-authentication-bypass-cisa-kev/)
- [A Djinn in the Machine: TaskWeaver's Node.js Intrusion Chain](https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/)
- [CVE-2026-48558 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48558)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2026-48558](https://www.tenable.com/cve/CVE-2026-48558)
- [Critical SimpleHelp flaw exploited to deploy new stealer malware](https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-simplehelp-flaw-deploy-new-djinn-infostealer-taskweaver-malware/)
- [Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer](https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html)
- [Djinn Stealer Targets Cloud and AI Credentials](https://www.darkreading.com/cyberattacks-data-breaches/djinn-stealer-targets-cloud-ai-credentials)
- [U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog](https://securityaffairs.com/194503/security/u-s-cisa-adds-simplehelp-flaw-to-its-known-exploited-vulnerabilities-catalog.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1122