SimpleHelp's 10.0 auth bypass: forge a token, own the RMM (CVE-2026-48558)

SimpleHelp is remote-support / RMM software — the kind of tool that, by design, can remote into, transfer files to, and run scripts on every machine it manages. CVE-2026-48558 turns that reach against you: when SimpleHelp is configured for OIDC single sign-on, it accepts the identity token presented at login without verifying its cryptographic signature (CWE-347). A remote, unauthenticated attacker forges a token carrying arbitrary identity claims and is handed a fully authenticated Technician session — the most privileged role. From there, the blast radius is the whole managed estate.

What CVE-2026-48558 actually is

Per the vendor advisory and the GitHub Security Advisory (GHSA-m93h-gjv2-fmq2), identity tokens submitted during the OIDC login flow are accepted without verifying their cryptographic signature. That breaks the trust relationship between the identity provider and SimpleHelp: the attacker, not the IdP, decides who you are. Horizon3.ai — whose AI-driven research system discovered the flaw — deliberately withheld the exact mechanism, so whether the failure is alg:none, a never-fetched signing key, or an unvalidated issuer is not public. We describe it as signature-unverified / forged, not literally unsigned.

It gets worse for defenders relying on MFA. Because the forged identity is treated as a brand-new technician, the attacker can register their own MFA device during first login — so organizational MFA never applies (the token never traversed the real IdP). The resulting technician account can remote into managed endpoints, run scripts across connected clients, and execute code on the server itself.

The exploitation chain

The whole attack hinges on one decision gate: is Allow group authenticated logins enabled on an OIDC-linked TechnicianGroup? If not, the bug is not exploitable (patch anyway — config drifts). If yes, the chain runs unauthenticated, end to end, with no user interaction. The cheapest place to break it is that gate; the most durable is the patch.

Am I affected?

You're exploitable only if all of these hold: you run an affected version, OIDC is configured, a TechnicianGroup is linked to that OIDC provider, and Allow group authenticated logins is enabled on it. That precondition is why only ~7.2% of internet-exposed servers are actually vulnerable (~1,000 of ~14,000, per Horizon3's own scans) — but you can't confirm it remotely, only on the server. Patch regardless: the fix is in code and config changes.

Exploited in the wild

Blackpoint Cyber's Adversary Pursuit Group documented the first public in-the-wild abuse on June 29, 2026: an attacker bypassed OIDC on an internet-facing SimpleHelp server, obtained a technician session, and used it to deploy a Node.js loader (tracked as TaskWeaver, masquerading as jquery.js) that pulled down Djinn Stealer — a cross-platform infostealer targeting developer and cloud secrets: SSH keys, cloud credentials, source-control and package-registry tokens, and crypto wallets. The actor is currently unattributed, and no ransomware was observed in this activity.

Detection & hunting

Hunt in two places. On the SimpleHelp server, look for the forged-login tells Horizon3 published (single-origin, so corroborate locally). On managed endpoints, hunt the Blackpoint-reported malware indicators (also single-origin). Two of the network indicators are abused legitimate services, so scope alerts to traffic originating from SimpleHelp-managed hosts rather than blocking the domains outright.

• Server log (/opt/SimpleHelp/logs/server.log and rotated copies): the literal strings Forged Attacker and [New Anon], plus any unexpected Registering technician login for <email>. An email of the form rapidresponse-<hex>@horizon3.ai indicates a Horizon3 test scan — benign, but it confirms the server is exploitable.
• Rogue accounts: review Administration → Technicians (enable 'Show Group Authenticated Users') for unfamiliar technicians, and watch for a new technician self-enrolling its own MFA device.
• Endpoint hashes (SHA-256): TaskWeaver loader 00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c; Djinn Stealer f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc.
• Process: node.exe <path>\jquery.js (a ~1.08 MB single-line obfuscated 'jQuery').
• Network (from managed hosts only): User-Agent telemetry-client/1.0; C2 a.dev-tunnels.com and staging *.trycloudflare.com (both abused legitimate Microsoft/Cloudflare tunnel services); exfil 96.126.130.126:58942 (Linode, likely ephemeral — pair with the UA).

# Preserve SimpleHelp logs + technician config BEFORE upgrading (KEV / BOD 26-04 triage)
tar czf /tmp/sh-triage-$(hostname).tgz /opt/SimpleHelp/logs/
grep -rEn 'Forged Attacker|\[New Anon\]|Registering technician login for|rapidresponse-.*@horizon3\.ai' /opt/SimpleHelp/logs/

What to do now

1. Triage before you patch (if exposed + unpatched). The KEV 3-day tier mandates preserving evidence first — collect /opt/SimpleHelp/logs/, audit the technician roster, and grep for the indicators above. Upgrading a compromised box can destroy attacker traces.
2. Upgrade to SimpleHelp 5.5.16 or 6.0 RC2. There is no partial fix.
3. If you can't patch in time: disable Allow group authenticated logins on the OIDC TechnicianGroup (this removes the precondition — but ensure a break-glass local admin first), IP-restrict technician login, and put the interface behind a VPN. If the deadline is unmeetable, document a formal risk acceptance.
4. If an MSP runs your SimpleHelp: escalate, get written confirmation of the patched build, and verify externally — you can't patch it yourself. An RMM compromise reaching your endpoints may trigger customer-notification and regulatory duties; loop in legal early.
5. Assume-breach cleanup if you were exposed: delete rogue technicians, invalidate all sessions, rotate OIDC client secrets, and on managed endpoints rotate cloud credentials, SSH keys, and source-control/registry tokens — Djinn Stealer's whole purpose is theft of exactly those.

FAQ

Sources

• Horizon3.ai — SimpleHelp authentication bypass disclosure + IoCs (primary research): https://horizon3.ai/attack-research/disclosures/CVE-2026-48558-simplehelp-authentication-bypass-iocs/
• GitHub Security Advisory GHSA-m93h-gjv2-fmq2 (root cause): https://github.com/advisories/GHSA-m93h-gjv2-fmq2
• SimpleHelp — Security Update 2026-05 (vendor advisory): https://simple-help.com/security/simplehelp-security-update-2026-05
• CISA — Adds One Known Exploited Vulnerability to Catalog (2026-06-29): https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog
• SecurityWeek — Critical SimpleHelp vulnerability exploited for malware delivery: https://www.securityweek.com/critical-simplehelp-vulnerability-exploited-for-malware-delivery/
• Help Net Security — SimpleHelp vulnerability exploited (Blackpoint, TaskWeaver/Djinn): https://www.helpnetsecurity.com/2026/06/30/simplehelp-vulnerability-exploited-CVE-2026-48558/
• The Hacker News — Attackers exploit SimpleHelp CVE-2026-48558: https://thehackernews.com/2026/06/attackers-exploit-simplehelp-cve-2026.html