CVE-2026-48558 SimpleHelp OIDC JWT Signature Bypass — Unauthorized Technician Account Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.