CVE-2026-48558

SimpleHelp is an RMM tool used to manage computers for your clients (and sometimes your own). This bug means the login system can be tricked: an attacker can send fake “proof of identity” and SimpleHelp accepts it, so the attacker can act as a fully logged-in technician. In practice, this can let attackers use your RMM access to push malware or steal credentials from affected computers.

This matters if you run SimpleHelp and use its OIDC authentication (OIDC is configured). It is a remote, unauthenticated problem—attackers do not need a login or user interaction—so exposure depends on whether SimpleHelp can be reached by attackers over the network. If SimpleHelp is reachable from the internet or otherwise reachable by an attacker, treat this as an immediate risk; otherwise the risk may be lower but is still serious once internet/reachable exposure is possible.

This is RED because confirmed real-world exploitation is reported and CISA listed it in the KEV catalog. Attackers are using this authentication bypass to compromise systems by dropping Djinn Stealer malware, meaning the window for action is very short. CISA requires mitigation according to vendor instructions by 2026-07-02.

1. Identify whether you are running an affected SimpleHelp version

   • Confirm the SimpleHelp version in your deployment.
   • Affected: SimpleHelp 5.5.15 and earlier; and SimpleHelp 6.0 pre-releases.

2. Identify whether OIDC authentication is configured

   • In your SimpleHelp configuration, check whether OIDC authentication is enabled.
   • If OIDC is configured and your version is affected, assume the login bypass is possible.

3. Determine your upgrade target (fixed versions)

   • Upgrade to SimpleHelp 5.5.16 (for the 5.5 line).
   • Upgrade to SimpleHelp 6.0 RC2 (for the 6.0 line).
   • If you are already on 6.0 but on a pre-release, move to 6.0 RC2.

4. Upgrade guidance / breaking-change notes

   • Use your vendor’s standard upgrade procedure for SimpleHelp.
   • Plan a maintenance window if technician access will be impacted during upgrade, and ensure rollback/backup steps are prepared per your normal change process.

5. If you cannot upgrade immediately (temporary mitigation)

   • Reduce network exposure: allow only trusted IPs/admin networks to reach the SimpleHelp web interface (and any related endpoints) and block access from the public internet if that is operationally possible.
   • Increase monitoring during the interim period for suspicious technician session creation and login activity consistent with forged-token behavior.

6. Verify remediation after upgrade

   • Re-test technician login behavior to ensure OIDC authentication continues to work correctly.
   • Review authentication logs for unusual session creation patterns and confirm that unauthorized access is no longer occurring.

7. Incident-readiness checks

   • Because exploitation has been reported in the wild (and is tied to malware delivery), check endpoints and management activity logs for signs of Djinn Stealer activity and follow your incident response playbook.

8. CISA timing

   • CISA KEV due date: 2026-07-02.
   • Follow CISA’s BOD 26-04 guidance: prioritize security updates based on risk; for cloud services, follow the applicable guidance; and if mitigations are unavailable, discontinue use as directed by CISA guidance.

Severity is critical in practice (attackers can gain full privileges): remote, unauthenticated access with full privileges is described for this issue in SimpleHelp. The underlying weakness is CWE-347 (improper verification of cryptographic signatures): in the OIDC authentication flow, identity tokens (JWTs) are accepted without verifying their cryptographic signature. Mechanism: attackers forge identity claims in a token and SimpleHelp creates a fully authenticated technician session without real token validation; user interaction is not required. Real-world exploitation is confirmed by KEV listing (added 2026-06-29) and by dated reporting that attackers exploited this auth-bypass in SimpleHelp RMM to drop Djinn Stealer malware on Windows/macOS/Linux and collect credentials across multiple platforms. No public exploit code is on record. EPSS is reported as 0.7% with a flat trend, but KEV/news confirmation controls urgency. KEV here means the vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog, indicating active abuse is occurring and requiring prioritized mitigation actions.