SimpleHelp OIDC Authentication Bypass
SimpleHelp 5.5.15 and prior accepts OIDC identity tokens without verifying their signature — a forged token yields a full technician session. CVSS 10.0, KEV, patch is 5.5.16.
- Vendor
- SimpleHelp
- Product
- SimpleHelp Server
- CVSS
- 10.0
- EPSS (exploit probability)
- 1.2%
- Status
- kev
- Published
Affected: SimpleHelp Server 5.5.15 and prior, and any 6.0 pre-release build. The bug is in the OIDC login flow — when OIDC is configured, the server accepts the identity token the client submits without ever verifying its cryptographic signature. A remote, unauthenticated attacker submits a forged token carrying arbitrary claims and lands in a fully authenticated technician session. In some deployments this also bypasses MFA, because MFA is bolted onto the local login path and the OIDC path skips it entirely. No user interaction required.
The technician role is the point. SimpleHelp Server is on-prem remote-support tooling — from a technician session an attacker can reach every endpoint enrolled with that server. That’s the entire reason CVSS scored this a 10.0 and CISA moved it into the Known Exploited Vulnerabilities catalog on 2026-06-29 with a 2026-07-02 federal patch deadline — that deadline has now passed.
What to do
- Upgrade to SimpleHelp 5.5.16 or later per the vendor security update. There is no supported mitigation short of the patch — the fix restores signature verification on the OIDC path.
- If you can’t upgrade immediately, disable OIDC on the SimpleHelp Server and restrict access to the management interface to a bastion/VPN allowlist. Local admin login is not affected by this specific bug.
- Assume compromise if the server has been reachable from the internet with OIDC configured. Horizon3.ai has published IoCs and Blackpoint Cyber has documented a related post-exploitation chain — check the server’s auth logs against those and inventory technician sessions created since the vendor advisory published 2026-05-27.
