CVE-2026-48558 SimpleHelp OIDC Bypass — Unauthenticated Technician Account Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•13

This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.