CVE-2026-48558 SimpleHelp OIDC JWT Bypass — Unauthenticated Technician Account Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.