Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2026-48558SimpleHelp accepts unsigned OIDC tokens, MFA bypass

critical
Product: SimpleHelpVendor: SimpleHelpCWE-347Disclosed: 2026-05-12Status: PatchedProtocol deep diveNVD ↗

What broke

SimpleHelp (remote support, through 5.5.15 and 6.0 pre-release) accepted OIDC ID tokens without checking the signature. alg:none worked. A forged token is a login, and it skipped MFA. The vendor patched. A public proof of concept is out.

Why it matters

Remote-support tools are privileged by design: they sit on admin workstations and jump boxes. An OIDC integration that does not verify the ID token is an MFA bypass with a support-tool blast radius. alg:none is a twenty-year-old JWT lesson. Seeing it in 2026 on a product that enterprises use to reach production is the story.

What to do

  • Patch SimpleHelp. If a public PoC exists and you were on 5.5.15 or earlier, review sessions and local accounts.
  • Confirm your OIDC client rejects alg:none and rejects tokens whose kid is missing from your JWKS.
  • Do not treat "we federated MFA through OIDC" as MFA if the RP never verifies the token.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.