SimpleHelp CVE-2026-48558 OIDC MFA Bypass via Forged Identity Token

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.