CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp's OpenID Connect authentication implementation. The flaw arises because the application does not verify cryptographic signatures on identity tokens, allowing attackers to submit forged tokens and gain fully authenticated technician sessions remotely. This access permits attackers to transfer files and execute commands on all systems managed by the compromised server. Observed attacks deployed two malware families: TaskWeaver, a Node.js loader used for system fingerprinting and payload deployment, and Djinn Stealer, designed to exfiltrate sensitive developer secrets including cloud credentials, SSH keys, source control tokens, development tooling credentials, and cryptocurrency wallets. The vulnerability was fixed in SimpleHelp versions 5.5.16 and 6.0 RC2 in late May 2026. The US CISA added this CVE to its Known Exploited Vulnerabilities catalog, urging rapid patching.

Successful exploitation grants attackers full authenticated technician access to SimpleHelp-managed systems, enabling arbitrary command execution and file transfers. This access was leveraged to deploy malware that steals a wide range of sensitive data, including credentials, SSH keys, cryptocurrency wallets, and development environment secrets. The compromise threatens confidentiality and integrity of managed systems and developer pipelines, potentially allowing attackers to tamper with development workflows and exfiltrate critical assets.

An official patch addressing this vulnerability is available in SimpleHelp versions 5.5.16 and 6.0 RC2. Organizations should promptly update to these versions or later. Additionally, reviewing application logs for unfamiliar technician names and email addresses can help identify potential compromises. No other vendor mitigation guidance indicates alternative or temporary fixes.