CVE-2026-48558

Deferred
Published: 12 Jun 2026, 17:07
Last modified:30 Jun 2026, 03:55

Vulnerability Summary

Overall Risk (default)
critical
90/100
CVSS Score
10 CRITICAL
v3.1 (cve.org)
EPSS Score
0.72% LOW
1% probability 0.00%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Jun 2026, 17:07
Published
Vulnerability first disclosed
29 Jun 2026, 00:00
Added to CISA KEV
SimpleHelp Authentication Bypass Vulnerability
30 Jun 2026, 03:55
Last Modified
Vulnerability information updated
02 Jul 2026, 00:00
CISA Remediation Due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

CVSS Metrics

  • v4.0•CRITICAL•Score: 9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
  • v4.0•CRITICAL•Score: 9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•CRITICAL•Score: 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.72%• Percentile: 49%

Techniques & Countermeasures

  • CWE-347•Improper Verification of Cryptographic Signature

    The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Systems

  • simplehelp•simplehelp

    ≥ 5.5.0, < 5.5.16 | ≥ 6.0, < 6.0 RC2

References (5)