CVE-2026-48558

CVE-2026-48558 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 29, 2026. EIP tracks 1 public exploit from researchers including J4ck3LSyN-Gen2.

AI-analyzed exploit summary This PoC exploits CVE-2026-48558, an OIDC authentication bypass in SimpleHelp servers (versions ≤5.5.15 and 6.0 pre-releases) by forging unsigned JWT tokens to gain unauthorized Technician access. The exploit targets the OIDC callback endpoint to impersonate privileged users without signature verification.

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.