SimpleHelp CVE-2026-48558 Rogue Technician Account Creation via OIDC Bypass

Ethan Andrews@eandrews

•updated Jun 29, 2026•0•0•6

This rule detects the exploitation of CVE-2026-48558 in SimpleHelp, where an OIDC authentication bypass allows unauthenticated attackers to forge identity tokens. The lack of cryptographic signature verification permits the registration of unauthorized, privileged Technician accounts, effectively bypassing MFA. The detection logic monitors for specific log patterns indicating OIDC response processing followed by technician account registration and configuration changes.