{"uuid": "7bb0ea1a-4bd8-4e3e-a768-89cf9f1de075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48558", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/simplehelp_oidc_auth_bypass_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Zach Hanley\", \"Horizon3.ai\", \"Blackpoint Cyber\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2026-48558 to forge an OpenID Connect identity token and\\n          obtain a SimpleHelp technician session. It then uses SimpleHelp's legitimate remote\\n          access WebSocket protocol to connect to an online managed machine and execute a\\n          payload through the remote terminal.\\n\\n          An OIDC provider must be enabled for a technician group that permits group-authenticated\\n          logins. The group must be allowed to access the selected machine and run remote commands.\\n          The SimpleHelp server must have a valid session license, and at least one managed machine\\n          must be online.\\n\\n          SimpleHelp 5.5.0 through 5.5.15 are affected. Some SimpleHelp 6.0 prerelease builds before\\n          6.0 RC2 are also affected.\", \"disclosure_date\": \"2026-06-12\", \"fullname\": \"exploit/multi/http/simplehelp_oidc_auth_bypass_rce\", \"is_install_path\": true, \"mod_time\": \"2026-09-01 14:06:12 +0000\", \"name\": \"SimpleHelp OIDC Authentication Bypass Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"config-changes\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/simplehelp_oidc_auth_bypass_rce.rb\", \"platform\": \"Linux,OSX,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/simplehelp_oidc_auth_bypass_rce\", \"references\": [\"CVE-2026-48558\", \"URL-https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/\", \"URL-https://guides.simple-help.com/kb---security-vulnerabilities-05-2026\", \"URL-https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Unix/Linux/macOS Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:11.694070Z"}