SimpleHelp RMM OIDC token forgery exploited for technician access
CVE-2026-48558, disclosed on June 12, 2026, lets an unauthenticated attacker forge OpenID Connect tokens against SimpleHelp servers configured for OIDC group login because token signatures are not properly validated, granting technician-level access without credentials or MFA. Arctic Wolf reported active exploitation, with attackers deploying custom malware to harvest credentials and persist across managed environments; CISA set a July 2, 2026 remediation deadline.
- Victim
- Multiple: SimpleHelp RMM servers using OIDC group login
- Industry
- Technology
- Country
- Global
- Intrusion began
- Not disclosed
- First disclosed
- Jun 30, 2026
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The server trusted identity tokens it never verified. Strict signature and issuer validation in any OIDC relying party, and keeping RMM consoles off the open internet, are the fixes.
Go deeper on SWI
Sources
- CVE-2026-48558: Critical authentication bypass vulnerability in SimpleHelp RMM exploited for credential theft and malware delivery, Arctic Wolf, Jun 30, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- FortiWeb authentication bypass exploited to create rogue admin accounts 2025 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). SimpleHelp RMM OIDC token forgery exploited for technician access. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-simplehelp-oidc-token-forgery/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.