A vulnerability in SimpleHelp's OpenID Connect authentication was reported to us,patched, and assigned CVE-2026-48558. If you are running SimpleHelp 5.5.16 orSimpleHelp 6.0 RC2 or later, your server is not affected. This post covers what the vulnerability is, who is at risk, and what you should do.
CVE-2026-48558 is an authentication bypass in SimpleHelp deployments that use OpenID Connect(OIDC) for technician login. The issue lies in how SimpleHelp validates assertions from the identity provider. Under certain configurations, an unauthenticated attacker can exploit this to register a new Technician account; without going through the configured identity provider.
Because Technician accounts can remotely access managed endpoints, run scripts, and perform administrative actions, unauthorised account creation carries risk. A successful attacker can gain the same level of access as a legitimate technician.
The vulnerability was discovered and responsibly disclosed to us by Horizon3.ai.
Not everySimpleHelp deployment is vulnerable. The attack requires all three of thefollowing conditions to be present:
If you do not use OIDC authentication, you are not affected. If you use OIDC but none of your TechnicianGroups have group-authenticated logins enabled, you are also not affected.
If the conditions above are met, an unauthenticated attacker can:
The attacker does not need an account, credentials, or access to your identity provider. They interact directly with the SimpleHelp server.
Patches areavailable now. Upgrade to either of the following:
Downloads are available on our Downloads page. Full details are in our security advisory: SimpleHelp Security Update 2026-05.
If you cannot patch immediately, you can restrict Technician authentication to approved source IP addresses as a temporary mitigation. This setting is available under Administration → Login Security.
How to Check Whether Your Server Was Targeted
Review all group-authenticated Technician accounts by navigating to:
Administration→ Technicians → Gear Icon → Show Group Authenticated Users
Look for any technician names or email addresses you do not recognise.
You can also review your server logs for entries indicating unauthorised technician registration. Relevant patterns to look for include:
Registering technician login for <email> / (Technicians)
Configuration save requested (<name> [New Anon])
SimpleHelpserver logs are located at:
The presence of [New Anon] in a configuration save entry is a strong indicator that an account was created via this vulnerability.
Action checklist:
If you have questions about your specific installation or want help assessing whether your server was targeted, contact our support team or post in the community forum.
SimpleHelp is a unified remote support and RMM platform, designed and built as one application since 2007. Learn more at simple-help.com.
