SimpleHelp Created Technician Accounts Without the Identity Provider
SimpleHelp CVE-2026-48558 trusted an OpenID Connect group mapping without always requiring the identity provider to authenticate the user. An attacker could create a technician account, enrol MFA and inherit the group’s remote-access permissions.
The vulnerability affects SimpleHelp 5.5.15 and earlier and certain 6.0 pre-release builds. The issue requires OIDC to be enabled, a Technician Group to be associated with it and the option allowing group-authenticated logins to be active. Network and authentication filters must also permit the attempt.
Those prerequisites narrow exposure, but the capability gained is significant. A technician can start remote sessions, run scripts and interact with managed endpoints. If the mapped group has server-administration rights, the new identity can gain even broader control.
The identity provider was present, but not authoritative
| Question | Verified answer |
|---|---|
| What is the flaw? | CVE-2026-48558, an OIDC authentication bypass that can create privileged technician identities |
| What versions are affected? | SimpleHelp 5.5.15 and earlier, plus affected 6.0 pre-release builds |
| What configuration is required? | OIDC enabled, a mapped Technician Group and the group-authenticated-login option enabled, with applicable filters allowing the request |
| What versions fix it? | SimpleHelp 5.5.16 and corrected 6.0 release-candidate or final builds |
| What can an attacker gain? | A technician account, attacker-controlled MFA enrolment and the permissions of the mapped group |
| Is exploitation confirmed? | The vendor and Horizon3 published technical details and indicators, but the cited vendor guidance does not confirm malicious exploitation in the wild. |
MFA could protect the attacker-created identity
The bypass is especially deceptive because the attacker can register a new MFA device after creating the technician identity. Administrators may then see an account using multifactor authentication and assume its creation was legitimate. MFA secures the session that follows; it does not repair a registration path that admitted the wrong person.
SimpleHelp says unexpected group-authenticated users are a key sign to review. Its configuration save log may also show a marker such as [New Anon] when an anonymous user is added. The vendor identifies log locations under /opt/SimpleHelp/logs/ for Linux installations.
Horizon3 reported the issue on 22 May after discovery on 21 May. SimpleHelp released fixed builds on 26 May, confirmed patching on 9 June and published public details and indicators on 12 June.
What defenders should do
- Upgrade to 5.5.16 or a corrected 6.0 build. Confirm the running server version after the update.
- Audit the OIDC configuration. Identify every mapped Technician Group, its permissions and whether group-authenticated logins were allowed.
- Review technician identities. Investigate unexpected group-authenticated users, recent account creation and unfamiliar MFA enrolments.
- Search the configuration save log. Look for the vendor’s anonymous-user indicator and correlate it with source IP addresses and session activity.
- Review endpoint actions. Examine remote sessions, scripts, file transfers and administrative changes performed by suspicious technicians.
- Reduce group privilege. Do not map identity-provider groups to more remote or server-administration rights than their members require.
The BlackTree view
The product displayed an identity-provider integration, but the vulnerable path could create a technician without the identity provider making the decisive authentication. That is a trust-boundary failure, not merely a login bug.
Remote-management tools turn identity into capability. Once a fake technician inherits a real group’s permissions, every managed endpoint becomes part of the incident scope. A newly enrolled MFA device can then make the fraudulent identity look stronger, not weaker.
Sources and publication details
- SimpleHelp security vulnerability guidance for May 2026, accessed 1 September 2026.
- SimpleHelp: What you need to know about the OIDC authentication bypass, public disclosure and indicators dated 12 June 2026. No publication time was provided.
