VYPR
← All advisories
Critical severity10.0CISA KEVNVD Advisory· Published Jun 12, 2026· Updated Oct 7, 2026

CVE-2026-48558

CVE-2026-48558

Description

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. No user interaction is required.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Simple Help/Simplehelp3 versions
    cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:simple-help:simplehelp:*:*:*:*:*:*:*:*range: <5.5.16
    • cpe:2.3:a:simple-help:simplehelp:6.0:pre-release:*:*:*:*:*:*
    • (no CPE)range: <=5.5.15, 6.0 pre-release

Patches

Vulnerability mechanics

References

5

News mentions

17