Actively Exploited SimpleHelp OIDC Flaw Enables Malware Delivery
Summary
CVE-2026-48558 lets attackers forge OIDC tokens to gain technician access to SimpleHelp servers. An observed attack deployed TaskWeaver and Djinn Stealer. SimpleHelp fixed the flaw in versions 5.5.16 and 6.0 RC2.
Key points
- The authentication bypass affects SimpleHelp’s OIDC flow, which fails to verify identity-token signatures.
- An unauthenticated attacker can submit a forged token to obtain a fully authenticated technician session.
- Access to an internet-facing server can enable file transfers and command execution on systems managed through it.
- Blackpoint observed an attacker use the access to deploy TaskWeaver, a Node.js loader, and Djinn Stealer, which targets developer secrets and other data.
- SimpleHelp addressed the flaw in versions 5.5.16 and 6.0 RC2; organizations are advised to update and check logs for unfamiliar technician names and email addresses.
- CISA added the vulnerability to its KEV catalog and urged federal agencies to patch within three days.
Article Details
- Vulnerability Types
- Authentication bypass through failure to verify OpenID Connect identity-token signatures
- Severity
- Critical (CVSS 10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1059.007 · JavaScriptTaskWeaver deployed a JavaScript payload that ran with full Node.js access.T1082 · System Information DiscoveryTaskWeaver performed system fingerprinting.T1105 · Ingress Tool TransferAfter gaining access to the SimpleHelp server, the attacker transferred files to systems managed through it.T1190 · Exploit Public-Facing ApplicationThe attacker exploited the authentication bypass on an internet-facing SimpleHelp server.T1550.001 · Application Access TokenThe attacker submitted a forged identity token to obtain a fully authenticated technician session.
CVE
Malware
Djinn StealerIn an attack observed by Blackpoint, a threat actor abused this access to deploy two malware families: TaskWeaver, a Node.js loader, and Djinn Stealer, a cross-platform information stealer.TaskWeaverIn an attack observed by Blackpoint, a threat actor abused this access to deploy two malware families: TaskWeaver, a Node.js loader, and Djinn Stealer, a cross-platform information stealer.