SimpleHelp OIDC Authentication Bypass

This repository is a small standalone Python proof-of-concept for CVE-2026-48558, an authentication bypass in SimpleHelp OIDC handling. It contains two files: a README with vulnerability background, affected versions, mitigation guidance, and usage examples; and poc.py, the actual exploit implementation. The exploit logic is straightforward and operational. The script accepts a target base URL and attacker-controlled OIDC claim values, auto-discovers likely OIDC callback endpoints by probing several common paths, forges a JWT id_token (defaulting to alg=none, with optional HS256), and submits it as form data to the discovered callback endpoint. It then evaluates success heuristically by checking HTTP status, redirect targets, response text keywords such as technician/dashboard/admin/console, and presence of likely authentication cookies. If successful, it saves session cookies to session.json. Main capabilities: - Automatic discovery of likely SimpleHelp OIDC callback endpoints - Forging unsigned or weakly signed JWT/OIDC id_tokens with arbitrary claims - Submission of forged id_token to the target callback endpoint - Basic success detection via response content, redirects, and cookies - Session cookie capture and local storage The attack vector is web-based and remote. The exploit targets vulnerable SimpleHelp servers where OIDC is enabled and token signature validation is not enforced. The code is not a scanner or detector; it is an active exploitation PoC intended to obtain authenticated technician access.