SimpleHelp CVE-2026-48558 OIDC Auth Bypass Technician Account Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.