CVE-2026-48558SimpleHelp accepts unsigned OIDC tokens, MFA bypass
What broke
SimpleHelp (remote support, through 5.5.15 and 6.0 pre-release) accepted OIDC ID tokens without checking the signature. alg:none worked. A forged token is a login, and it skipped MFA. The vendor patched. A public proof of concept is out.
Why it matters
Remote-support tools are privileged by design: they sit on admin workstations and jump boxes. An OIDC integration that does not verify the ID token is an MFA bypass with a support-tool blast radius. alg:none is a twenty-year-old JWT lesson. Seeing it in 2026 on a product that enterprises use to reach production is the story.
What to do
- Patch SimpleHelp. If a public PoC exists and you were on 5.5.15 or earlier, review sessions and local accounts.
- Confirm your OIDC client rejects
alg:noneand rejects tokens whosekidis missing from your JWKS. - Do not treat "we federated MFA through OIDC" as MFA if the RP never verifies the token.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- CVEBlast-RADIUS, MD5 collision forges Access-Accept
A chosen-prefix MD5 collision on the RADIUS Response Authenticator lets a man-in-the-middle forge Access-Accept, bypass MFA, and escalate when CHAP/PAP run with
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEKeycloak session hijack via prompt=login re-authentication
Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Pa