SimpleHelp CVE-2026-48558 — Unauthorized Technician Account via OIDC Bypass [New Anon]

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.