SimpleHelp versions 5

SimpleHelp's OIDC login flow accepts an identity token from the configured provider but never validates the cryptographic signature on it (CWE-347). That means an unauthenticated attacker on the internet can hand-craft a JWT claiming to be any technician, hand it to the server, and walk away with a fully authorized technician session — which by default includes remoting into every managed endpoint, pushing scripts, and creating new privileged accounts. Affected builds are SimpleHelp ≤ 5.5.15 on the stable channel and all 6.0 pre-release builds; fixes are in 5.5.16 and 6.0 RC2. MFA does not save you — first-login self-enrollment means the attacker enrolls their own factor.

Vendor's CRITICAL/9.8 rating is accurate and arguably understated for the deployment role. SimpleHelp is an RMM — by definition a privileged egress point into hundreds or thousands of downstream endpoints — and the bug is pre-auth, network-reachable, low-complexity, with scope change and full CIA impact. CISA KEV listed it on 2026-06-29 with a 14-day federal remediation deadline; Djinn Stealer is being dropped on victims in the wild. Friction is essentially zero.

Why this verdict

• Role multiplier: SimpleHelp's high-value role IS its only role — every install is an RMM with admin reach into managed endpoints. The chain ends in fleet compromise on success, not just server compromise. This is canonical CRITICAL floor territory (cf. Kaseya VSA, ConnectWise ScreenConnect CVE-2024-1709).
• Pre-auth, network-reachable, low-complexity: the attacker needs nothing but the URL and a forged JWT — no credentials, no user interaction, no internal foothold.
• KEV-listed and actively exploited: Djinn Stealer campaigns observed, CISA 14-day deadline issued. Any downgrade argument dies here.
• Friction is minimal: the ~7.2% OIDC-enabled subset still represents ~1,000 directly exposed servers, each fronting hundreds of endpoints. The bug also affects pre-release 6.0 admins who think they're safe on the new train.
• MFA bypass built into the same flaw: first-login self-enrollment means defenders who thought MFA was their compensating control are wrong.

Why not higher?

9.8 is already the practical ceiling for a remote-code-equivalent CVSS 3.1 score. There is no defensible move to 10.0 without changes to the scoring rubric.

Why not lower?

Every friction lever a defender would cite — auth requirement, narrow population, no PoC, no KEV — is absent here. Pre-auth, public detail, KEV-listed, active campaigns, RMM blast radius. Downgrading would be malpractice.

1. Disable OIDC on the SimpleHelp server until patched — In the SimpleHelp admin console under Authentication, switch OIDC off and force technicians to local credentials + MFA. This removes the vulnerable code path entirely. Do this within hours — the noisgate mitigation SLA for CRITICAL is ≤ 3 days but active KEV exploitation overrides that to immediate.
2. Block internet access to the SimpleHelp web UI — If the server has no business being public, put it behind a VPN, Cloudflare Access, or a source-IP allowlist for your technicians' egress. Most MSPs do not need world-readable RMM consoles. Implement within hours.
3. Upgrade to SimpleHelp 5.5.16 (or 6.0 RC2 if on the pre-release channel) — This is the actual fix. Patch deployment per the noisgate remediation SLA for CRITICAL is ≤ 90 days, but given KEV listing this collapses to immediate — schedule the upgrade tonight, not next sprint.
4. Rotate every technician credential and revoke all existing sessions — Assume sessions were created; force re-authentication after patching. Audit the technician roster for accounts you did not create.
5. Hunt for indicators of compromise from Horizon3 + BlackPoint — Pull SimpleHelp audit logs for unexpected technician logins since 2026-06-12, look for new MFA enrollments on existing accounts, and scan managed endpoints for Djinn Stealer IOCs.

Run on an auditor workstation that can HTTP-reach the SimpleHelp server. Invoke as ./check_simplehelp.sh https://rmm.example.com. No privileges required; this only reads the public version banner.

#!/usr/bin/env bash
# noisgate check for CVE-2026-48558 (SimpleHelp OIDC signature-skip auth bypass)
# Output: VULNERABLE / PATCHED / UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 https://simplehelp.example.com" >&2
  exit 2
fi

# SimpleHelp exposes its version at /allconfig/info or in the page footer
RESP=$(curl -ksS --max-time 10 "$TARGET/allconfig/info" || true)
if [[ -z "$RESP" ]]; then
  RESP=$(curl -ksS --max-time 10 "$TARGET/" || true)
fi

VER=$(echo "$RESP" | grep -Eoi 'SimpleHelp[^0-9]{0,10}([0-9]+\.[0-9]+\.[0-9]+)' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse SimpleHelp version from $TARGET" >&2
  exit 3
fi

MAJ=$(echo "$VER" | cut -d. -f1)
MIN=$(echo "$VER" | cut -d. -f2)
PAT=$(echo "$VER" | cut -d. -f3)

# Vulnerable: <= 5.5.15  OR  any 6.0 pre-release
# Patched:    5.5.16+    OR  6.0 RC2+
if (( MAJ < 5 )) || { (( MAJ == 5 )) && (( MIN < 5 )); }; then
  echo "VULNERABLE: SimpleHelp $VER (predates 5.5.16 fix)"; exit 1
fi
if (( MAJ == 5 )) && (( MIN == 5 )) && (( PAT <= 15 )); then
  echo "VULNERABLE: SimpleHelp $VER (<= 5.5.15)"; exit 1
fi
if (( MAJ == 6 )) && (( MIN == 0 )) && (( PAT == 0 )); then
  echo "VULNERABLE: SimpleHelp 6.0 pre-release ($VER) — confirm RC2 or later out-of-band"; exit 1
fi

echo "PATCHED: SimpleHelp $VER"
exit 0

Sources

1. Horizon3.ai — CVE-2026-48558 disclosure
2. Horizon3.ai — IOCs
3. Help Net Security — exploit + Djinn Stealer
4. Help Net Security — initial disclosure coverage
5. SOCRadar analysis
6. Rescana technical writeup
7. Daily Security Review — exposure data
8. Cyberpress — technician session takeover