Loading vulnerability…
CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp Remote Monitoring and Management software versions 5.5.15 and earlier and affected 6.0 pre-release builds. In the OpenID Connect authentication flow, SimpleHelp accepts submitted identity tokens without verifying their cryptographic signatures. A remote unauthenticated attacker can forge an identity token containing arbitrary identity claims and obtain a fully authenticated Technician session. The flaw is CWE-347, Improper Verification of Cryptographic Signature. In affected configurations, an attacker can also bypass multi-factor authentication by registering attacker-controlled authentication methods during initial access.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small standalone Python proof-of-concept for CVE-2026-48558, an authentication bypass in SimpleHelp OIDC handling. It contains two files: a README with vulnerability background, affected versions, mitigation guidance, and usage examples; and poc.py, the actual exploit implementation. The exploit logic is straightforward and operational. The script accepts a target base URL and attacker-controlled OIDC claim values, auto-discovers likely OIDC callback endpoints by probing several common paths, forges a JWT id_token (defaulting to alg=none, with optional HS256), and submits it as form data to the discovered callback endpoint. It then evaluates success heuristically by checking HTTP status, redirect targets, response text keywords such as technician/dashboard/admin/console, and presence of likely authentication cookies. If successful, it saves session cookies to session.json. Main capabilities: - Automatic discovery of likely SimpleHelp OIDC callback endpoints - Forging unsigned or weakly signed JWT/OIDC id_tokens with arbitrary claims - Submission of forged id_token to the target callback endpoint - Basic success detection via response content, redirects, and cookies - Session cookie capture and local storage The attack vector is web-based and remote. The exploit targets vulnerable SimpleHelp servers where OIDC is enabled and token signature validation is not enforced. The code is not a scanner or detector; it is an active exploitation PoC intended to obtain authenticated technician access.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
216 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability affecting the SimpleHelp remote monitoring and management (RMM) tool that was exploited to obtain an authenticated technician session on an internet-facing server, enabling abuse of a trusted remote-administration platform.
A vulnerability in SimpleHelp that was exploited before the observed TaskWeaver and Djinn Stealer intrusion chain. The content provides no technical vulnerability details.
A vulnerability identified as CVE-2026-48558. The content only references creation of its YAML record and provides no technical vulnerability details.
A vulnerability in the SimpleHelp remote support platform.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.