{"id":"simplehelp-oidc-login-bypass-may-2026","category":"patch","status":"closed","title":"SimpleHelp sign-in bypass CVE-2026-48558 exploited to spread credential-stealing malware; fixes available","tldr":"Attackers used a SimpleHelp sign-in flaw to reach computers managed by IT support providers and install credential-stealing malware. Ask your provider to update its server to 5.5.16 or 6.0 RC2 or later and check for unauthorised access.","summary":"CVE-2026-48558 lets attackers gain technician access to vulnerable SimpleHelp remote support servers without a valid password. It affects certain OpenID Connect (OIDC) single sign-on configurations: an identity provider must be configured, linked to a technician group, and that group must allow group-authenticated logins. Attackers can then access managed computers and run software. SimpleHelp dates its fixes, 5.5.16 and 6.0 RC2, to 26 May; BleepingComputer reported 9 June, which SimpleHelp identifies as the date researchers confirmed patch availability. On 29 June, Blackpoint Cyber reported a contained intrusion involving TaskWeaver and Djinn Stealer, which targets credentials, browser data and cryptocurrency wallets. CISA listed the flaw as exploited that day. As at 3 November, fixes cover both affected branches, but updating alone does not remove stolen credentials or existing intruders. The reviewed sources do not establish that the wider attacks have ended.","action":"If an IT support provider uses SimpleHelp to manage your family’s or business’s computers, ask them to update the server to 5.5.16 or 6.0 RC2 or later and check technician accounts and logs for unauthorised access. If compromise is found, have them investigate managed computers, end unauthorised sessions and replace exposed credentials.","product":"SimpleHelp remote support and remote monitoring and management server","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-48558"],"tags":["simplehelp","remote-support","authentication-bypass","actively-exploited","credential-theft"],"affected":["SimpleHelp 5.5.0 to 5.5.15 with OIDC configured, an associated TechnicianGroup, and “Allow group authenticated logins” enabled","SimpleHelp 6.0 pre-release versions before 6.0 RC2 with the same OIDC and TechnicianGroup configuration"],"fixed":["SimpleHelp 5.5.16","SimpleHelp 6.0 RC2"],"matches":[],"sources":[{"kind":"advisory","title":"SimpleHelp 5.5 and 6.0 Security Fix","url":"https://simple-help.com/security/simplehelp-security-update-2026-05","by":"SimpleHelp","date":"2026-05-26"},{"kind":"post","title":"Release News","url":"https://simple-help.com/release-news","by":"SimpleHelp","date":""},{"kind":"advisory","title":"CVE-2026-48558: What You Need to Know About the SimpleHelp OIDC Authentication Bypass","url":"https://simple-help.com/blogs/cve-2026-48558-what-you-need-to-know-about-the-simplehelp-oidc-authentication-bypass","by":"SimpleHelp","date":""},{"kind":"research","title":"A Djinn in the Machine: TaskWeaver’s Node.js Intrusion Chain","url":"https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/","by":"Blackpoint Cyber","date":"2026-06-29"},{"kind":"news","title":"SimpleHelp bug lets hackers create rogue remote support accounts","url":"https://www.bleepingcomputer.com/news/security/simplehelp-bug-lets-hackers-create-rogue-remote-support-accounts/","by":"BleepingComputer","date":"2026-06-15"},{"kind":"news","title":"SimpleHelp vulnerability exploited to deliver mighty Djinn Stealer (CVE-2026-48558)","url":"https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-cve-2026-48558/","by":"Help Net Security","date":"2026-06-30"},{"kind":"advisory","title":"SimpleHelp security advisory (AV26-642)","url":"https://www.cyber.gc.ca/en/alerts-advisories/simplehelp-security-advisory-av26-642","by":"Canadian Centre for Cyber Security","date":"2026-06-30"},{"kind":"advisory","title":"CVE-2026-48558","url":"https://www.cve.org/CVERecord?id=CVE-2026-48558","by":"CVE Program","date":"2026-06-12"}],"started":"2026-06-29","closed":"2026-06-30","created":"2026-11-03T22:22:58.391Z","updated":"2026-11-03T22:22:58.391Z","cve_notes":[{"cve":"CVE-2026-48558","name":"SimpleHelp OIDC sign-in authentication bypass","what":"Missing signature verification in SimpleHelp’s OIDC sign-in can let an unauthenticated attacker gain technician access to managed computers, sometimes bypassing multi-factor authentication.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-06-30","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"The Canadian Centre for Cyber Security urged administrators to apply the available updates following CISA’s listing.","url":"https://www.cyber.gc.ca/en/alerts-advisories/simplehelp-security-advisory-av26-642","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-29","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue, confirming use in real attacks.","url":"https://www.cyber.gc.ca/en/alerts-advisories/simplehelp-security-advisory-av26-642","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-29","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"Blackpoint Cyber reported an intrusion it investigated and contained in which attackers used the flaw to gain technician access and deploy TaskWeaver and Djinn Stealer across managed computers.","url":"https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/","by":"Blackpoint Cyber","patch":null},{"at":"2026-06-12","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Horizon3.ai publicly disclosed CVE-2026-48558 and published indicators administrators could use to investigate suspicious technician accounts.","url":"https://simple-help.com/blogs/cve-2026-48558-what-you-need-to-know-about-the-simplehelp-oidc-authentication-bypass","by":"SimpleHelp","patch":null},{"at":"2026-05-26","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"SimpleHelp released 5.5.16 and 6.0 RC2 to fix the vulnerability in its stable and pre-release branches.","url":"https://simple-help.com/blogs/cve-2026-48558-what-you-need-to-know-about-the-simplehelp-oidc-authentication-bypass","by":"SimpleHelp","patch":"patched"},{"at":"2026-05-21","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Horizon3.ai discovered the authentication bypass and validated it in real-world environments. It reported the flaw to SimpleHelp on 22 May.","url":"https://simple-help.com/blogs/cve-2026-48558-what-you-need-to-know-about-the-simplehelp-oidc-authentication-bypass","by":"SimpleHelp","patch":"none"}],"url":"https://hard.fyi/live/simplehelp-oidc-login-bypass-may-2026/","json":"https://hard.fyi/api/live?id=simplehelp-oidc-login-bypass-may-2026"}