Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-48558

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.012
EPSS Ranking 64.9%
CVSS Severity
CVSS v3 Score 10.0
Proposed Action
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
Ransomware Campaign
Unknown
Products affected by CVE-2026-48558


Products
Pricing
Contact Us

Shodan ® - All rights reserved