Critical SimpleHelp Flaw Lets Hackers Create Rogue Admin Accounts

A critical vulnerability in SimpleHelp remote management software, tracked as CVE-2026-48558, enables unauthenticated attackers to create privileged Technician accounts on servers using OpenID Connect (OIDC) authentication. Researchers at offensive security firm Horizon3.ai, led by Zach Hanley, discovered that the flaw stems from improper validation of identity assertions received from OIDC identity providers. When exploited, an attacker can register and log in as a new Technician user without ever completing multi-factor authentication, gaining the ability to remote into managed endpoints, execute scripts, and perform other privileged management activities. The vulnerability carries a critical severity rating and impacts SimpleHelp versions 5.5.15 and earlier, as well as 6.0 pre-release builds. SimpleHelp patched the issue on June 9 by releasing versions 5.5.16 and 6.0RC2.

The flaw does not affect every vulnerable SimpleHelp server. Exploitation requires three specific prerequisites: OIDC authentication must be enabled, at least one Technician Group must be linked to the OIDC provider, and the group must have “Allow group authenticated logins” enabled. According to Shodan data, approximately 14,000 SimpleHelp servers are exposed to the public internet, and analysis of a random sample suggests roughly 7.2% are configured to use OIDC authentication. Horizon3.ai found that the “Allow group authenticated logins” setting is frequently enabled in real-world deployments, expanding the attack surface considerably. Organizations using Azure AD OIDC or generic OIDC integrations—both common in large enterprise environments—should treat this as an urgent remediation priority. Security teams can audit their own exposure with a port scanner to identify publicly accessible SimpleHelp instances.

SimpleHelp and Horizon3.ai have not yet observed active exploitation in the wild, but the product’s history of attracting threat actor interest makes prompt patching essential. Organizations that cannot immediately update should restrict technician login sources using IP-based allowlists, verified through a VPN/proxy detector to ensure traffic originates from trusted networks. Security teams should also monitor for indicators of compromise, including new authenticated technician users with unfamiliar names or email addresses, and review logs located at /opt/SimpleHelp/logs/server.log for unauthorized registrations and configuration changes. Given the severity of the privilege escalation potential, defenders should run a SSL/TLS checker on all SimpleHelp endpoints to confirm transport security is properly configured alongside the patch deployment.