SimpleHelp Authentication Bypass Vulnerability

SimpleHelp SimpleHelp

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. Added to CISA KEV on 2026-06-29 (federal deadline 2026-07-02).

First seen: 29 Jun 2026
Last update: 29 Jun 2026, 12:00 UTC
Identifiers: CVE-2026-48558
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## SimpleHelp Authentication Bypass Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: SimpleHelp SimpleHelp
Ids: CVE-2026-48558

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. Added to CISA KEV on 2026-06-29 (federal deadline 2026-07-02).

## Steps
1. Search the repo, its CI and infra config for SimpleHelp SimpleHelp. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-48558") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-48558 https://simple-help.com/security/simplehelp-security-update-2026-05
https://pwned.coffee/i/simplehelp-authentication-bypass-vulnerability-cve-2026-48558

Sources

Totalone hot coffee