CVE-2026-48558: Critical SimpleHelp RMM Authentication Bypass — Unsigned OIDC Tokens Enable Full MSP Takeover

Executive Summary

CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software, carrying a CVSS v3.1 score of 10.0 (Critical). The flaw resides in the OIDC (OpenID Connect) authentication flow: the server accepts identity tokens without verifying their cryptographic signature. A remote, unauthenticated attacker can forge a token containing arbitrary identity claims, create a Technician account on the RMM server, and gain full administrative control over every managed endpoint.

CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 29, 2026, with a remediation deadline of July 2, 2026, under Binding Operational Directive (BOD) 26-04. Real-world exploitation is confirmed: attackers are deploying the TaskWeaver loader and Djinn Stealer malware through compromised SimpleHelp instances CISA KEV. Any organization using SimpleHelp for remote management — and any customer of an MSP using it — is at immediate risk. The patch (version 5.5.16) has been available since June 5, 2026 SimpleHelp Security Advisory.

CVE Details

Field	Value
CVE ID	CVE-2026-48558
CVSS v3.1 Score	10.0 (Critical)
CVSS v3.1 Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
CVSS v4.0 Score	9.5 (Critical)
CWE	CWE-347 — Improper Verification of Cryptographic Signature
Published	June 12, 2026
CISA KEV Added	June 29, 2026
Exploitation Status	Confirmed in the wild
Patch Available	Yes (SimpleHelp 5.5.16, released June 5, 2026)

CVSS v3.1 Vector Breakdown

Metric	Value	What It Means
AV (Attack Vector)	Network (N)	The vulnerability can be exploited remotely over the internet — no physical access or local network proximity required
AC (Attack Complexity)	Low (L)	No special conditions, race conditions, or unusual network circumstances are needed; the attack is straightforward
PR (Privileges Required)	None (N)	The attacker does not need any valid credentials or existing access to the system before exploiting this flaw
UI (User Interaction)	None (N)	No victim action (clicking a link, opening a file, approving a prompt) is required for the exploit to succeed
S (Scope)	Changed (C)	The exploited component affects resources beyond its original security scope — a compromised RMM server reaches all managed endpoints
C (Confidentiality)	High (H)	Full read access to all data traversing the RMM server and all managed endpoints
I (Integrity)	High (H)	Full write access — attackers can modify data, deploy software, and alter configurations on all managed systems
A (Availability)	High (H)	Full control to disrupt, encrypt, or destroy systems on all managed endpoints

The Scope: Changed qualifier is critical here: it means the attack doesn’t just compromise the RMM server itself — it cascades to every system the RMM server manages. This is the hallmark of an MSP supply chain vulnerability.

Affected Systems

Product	Affected Versions	Patched Version
SimpleHelp (RMM)	5.5.15 and prior	5.5.16
SimpleHelp (RMM)	6.0 pre-release versions	6.0 stable (pending)

SimpleHelp is a Remote Monitoring and Management platform used by Managed Service Providers (MSPs) and IT departments to remotely manage endpoints at scale. A single SimpleHelp server typically manages hundreds to thousands of client workstations and servers, with full administrative privileges including software deployment, script execution, registry editing, file transfer, and remote desktop control.

Service Surface Mapping

The OIDC authentication module is part of the SimpleHelp server’s web management interface. When OIDC is enabled (configured via the server’s Settings → Authentication panel), the vulnerable token validation endpoint processes all login requests. The flaw is triggered during the OIDC callback — the point at which the identity provider’s response is received and processed. Any network-facing SimpleHelp server with OIDC enabled is exposed.

Root Cause

The vulnerability is classified as CWE-347: Improper Verification of Cryptographic Signature. In the OpenID Connect protocol flow, when a user authenticates via an external identity provider (IdP), the IdP issues a signed ID token (a JWT) containing identity claims (username, email, groups, roles). The relying party (SimpleHelp server) is supposed to validate this token by:

Verifying the JWT signature against the IdP’s public key
Checking the iss (issuer) claim matches the expected IdP
Checking the aud (audience) claim matches the client ID
Validating the token has not expired (exp claim)

The flaw in SimpleHelp is that step 1 was omitted entirely for OIDC authentication. The server parses the JWT payload and trusts its claims without verifying the cryptographic signature. This means an attacker can craft a JWT containing arbitrary fields — including a sub (subject) claim set to any username — and the SimpleHelp server will accept it as a valid authentication token.

The missing signature verification is equivalent to accepting unsigned identity assertions. In the context of OIDC, this is a catastrophic failure of the trust model. The protocol is specifically designed to prevent token forgery through public-key cryptography; removing that check makes the entire authentication system trivially bypassable.

Horizon3.ai’s advisory confirmed the root cause through independent analysis, noting that the SimpleHelp server performs no signature validation on incoming OIDC tokens. The vendor’s security update advisory confirmed the finding and released the fix in version 5.5.16.

Exploit Analysis

Attack Surface Enumeration

The attack surface for CVE-2026-48558 consists of:

Network-accessible SimpleHelp server with OIDC enabled — the only precondition for exploitation
OIDC authentication endpoint — the /oidc/callback or equivalent URL path that processes identity provider responses
No valid credentials required — the attacker needs nothing more than network access to the server

Exploitation Mechanics

The exploitation follows these steps:

Reconnaissance: The attacker identifies a SimpleHelp server (typically on TCP ports 80/443, or SimpleHelp’s default ports 8080/8443) with OIDC authentication enabled.
Token forgery: The attacker crafts a JWT with the following structure:
```
{
  "sub": "technician",
  "name": "Admin User",
  "email": "[email protected]",
  "groups": ["Administrators"],
  "iat": 1719878400,
  "exp": 2524608000
}
```
This JWT is unsigned or uses a self-generated key — the signature validation is never checked by the vulnerable server.
Session acquisition: The forged token is submitted to the SimpleHelp OIDC callback endpoint. The server parses the claims, creates or maps to a Technician account, and issues an authenticated session.
Privilege escalation: The attacker’s session has full Technician privileges, including remote access to all managed endpoints.
Lateral movement: Using the RMM’s native deployment capabilities, the attacker deploys malware (TaskWeaver loader, Djinn Stealer) to managed endpoints.

Wormability Assessment

Wormability: Moderate. The vulnerability itself is a server-side authentication bypass, not a self-propagating code execution flaw. However, once an attacker compromises a SimpleHelp server, they gain the ability to deploy arbitrary software to all managed endpoints. This means a single compromised SimpleHelp server can lead to widespread malware deployment across the entire MSP’s client base. The attack is human-directed (not automated worm propagation), but the blast radius is extreme due to the RMM’s privileged position in the network architecture.

Real-World Exploitation

According to BleepingComputer, threat actors exploited CVE-2026-48558 to deploy the TaskWeaver loader — a Node.js-based malware loader — and the Djinn Stealer information stealer. TaskWeaver acts as a first-stage payload dropper, establishing persistence and downloading additional modules. Djinn Stealer targets credentials stored in browsers, cryptocurrency wallets, and cloud service provider CLI tools, with a specific focus on AI/ML platform credentials (AWS SageMaker, Google Cloud AI, OpenAI API keys) Dark Reading.

BlackPoint Cyber published a detailed breakdown of the TaskWeaver intrusion chain, describing it as “a Node.js-based modular framework that establishes persistent access, performs credential harvesting, and deploys additional payloads on demand” BlackPoint Cyber.

Proof of Concept

A public proof of concept for CVE-2026-48558 was published by Horizon3.ai as part of their advisory. The conceptual approach is straightforward:

Intercept the normal OIDC authentication flow to understand the expected token format
Generate a forged JWT with arbitrary claims using the sub field set to match an existing SimpleHelp user or a new username
Submit the forged token to the OIDC callback endpoint
Receive a valid session cookie granting Technician-level access

The core technical detail is that the JWT signature header algorithm (alg field) can be set to none or any value — the server performs no signature validation at all. This is the simplest possible form of JWT authentication bypass, analogous to the well-known “JWT none algorithm” attack class that has been documented for years.

Detection

Log-Based Detection

SimpleHelp server logs should be examined for the following indicators:

OIDC authentication events lacking a corresponding IdP audit log entry: Each successful OIDC login via a legitimate IdP should have a matching log entry on the IdP side. OIDC authentications without IdP-side records indicate token forgery.
Technician account creation events outside normal business hours: Monitor for new Technician accounts created via OIDC authentication where the identity does not match known personnel.
Multiple failed OIDC token validation attempts followed by a successful login: While the vulnerability bypasses validation, some scanning behavior may still appear in logs.

Network-Based Detection

Unusual JWT tokens in OIDC callback requests: Examine OIDC callback POST bodies for JWTs with suspicious header values, missing signatures, or alg: none settings.
Connections from management IPs to unusual external hosts: After SimpleHelp compromise, the RMM server may establish outbound connections to C2 infrastructure.

SIEM Queries

Splunk query for OIDC anomaly detection:

index=simplehelp sourcetype=simplehelp:auth
"OIDC" "authentication" NOT "IdP=expected-issuer-value"
| stats count by src_ip, user, _time
| where count > 3

Microsoft Sentinel KQL:

SimpleHelpServerLogs
| where EventType == "OIDCAuthentication"
| where IdPVerificationStatus != "verified"
| summarize AuthAttempts = count() by SourceIP, TargetAccount, bin(TimeGenerated, 5m)
| where AuthAttempts > 1

IOCs

Horizon3.ai published specific IoCs in their advisory, including:

TaskWeaver loader file hashes
Djinn Stealer C2 infrastructure IP addresses
SimpleHelp server-side forensic indicators (unauthorized Technician accounts, unexpected OIDC provider configurations)

Refer to the Horizon3.ai advisory for the complete indicator set.

Mitigation

Patching (Primary)

Update SimpleHelp to version 5.5.16 or later. The patch was released on June 5, 2026, and addresses the OIDC signature validation bypass. The vendor’s security advisory and download link are available at SimpleHelp Security Update.

Compensating Controls

If immediate patching is not possible:

Disable OIDC authentication on SimpleHelp servers where it is not strictly required. Use local authentication or a properly validated SSO solution instead.
Restrict network access to SimpleHelp management interfaces: place servers behind VPN or bastion hosts, never expose the management UI directly to the internet.
Audit all Technician accounts on every SimpleHelp server. Remove any accounts that do not correspond to known personnel. Pay special attention to accounts created via OIDC.
Review managed endpoints for unexpected software deployments, particularly Node.js-based processes (indicative of TaskWeaver) and unusual scheduled tasks.

Firewall Rules

# Restrict access to SimpleHelp management ports
iptables -A INPUT -p tcp --dport 8080 -s <trusted-mgmt-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -A INPUT -p tcp --dport 8443 -s <trusted-mgmt-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP

Inventory Checklist

Identify all SimpleHelp servers in the environment
Verify OIDC is disabled where not required
Apply SimpleHelp 5.5.16 patch
Audit all Technician accounts
Check managed endpoints for TaskWeaver/Djinn Stealer indicators
Rotate all RMM credentials after patching
Verify CISA KEV deadline compliance (BOD 26-04)

Timeline

Date	Event
2026-06-05	SimpleHelp releases version 5.5.16 with the OIDC signature validation fix
2026-06-12	CVE-2026-48558 is publicly disclosed and published in the NVD
2026-06-12	Horizon3.ai publishes advisory with technical details and IoCs
2026-06-15	BleepingComputer reports on the vulnerability and exploitation potential
2026-06-29	CISA adds CVE-2026-48558 to the Known Exploited Vulnerabilities catalog
2026-06-29	Active exploitation confirmed — TaskWeaver and Djinn Stealer deployments reported
2026-06-30	CISA KEV deadline set to July 2, 2026 (3-day window under BOD 26-04)
2026-07-02	CISA KEV deadline — all federal agencies required to remediate
2026-07-04	This analysis published