CVE-2026-48558 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-48558CRITICAL

SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   P   N   N   H   H   H    9.5   .1148   95.7   YES

AFFECTED
  Product     Versions  Fixed
  SimpleHelp  5.5.0 –   —

TIMELINE
  May 21  Reserved by VulnCheck
  Jun 12  EXPLOIT PUBLISHED — CVE-2026-48558 (SimpleHelp). Public exploit reference added.
  Jun 29  Added to CISA KEV, remediation due 2026-07-02
  Jun 29  Published (CNA: VulnCheck)
  Jul 3   DUE DATE PASSED — CVE-2026-48558 (SimpleHelp). CISA remediation deadline was July 2, 2026; still in catalog.

CWE-347 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Analyzed · KEV due July 2, 2026

Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

Lifecycle

Complete event history — 5 events, chronological
Date	Event	Detail
May 21, 2026	Reserved	Reserved by VulnCheck
June 12, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48558 (SimpleHelp). Public exploit reference added.
June 29, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-07-02
June 29, 2026	Published	Published (CNA: VulnCheck)
July 3, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-48558 (SimpleHelp). CISA remediation deadline was July 2, 2026; still in catalog.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
SimpleHelp	SimpleHelp	—	5.5.0	—

Weaknesses

CWE-347

References (5)

https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/ [Technical Description, Third Party Advisory]
https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/ [Third Party Advisory]
https://simple-help.com/release-news [Release Notes]
https://simple-help.com/security/simplehelp-security-update-2026-05 [Patch, Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558 [US Government Resource]

Authoritative record: CVE-2026-48558 at cve.org

Vendors: simplehelp

Weaknesses: CWE-347

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-48558 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.