SeleceHelp Critical Fault Allows to Create Advanced Technical Accounts and Eludir MFA with OpenID Connect CVE 2026 48558

A critical failure in the SpleHelp remote management software (CVE-2026-48558) allows non-authenticated attackers to create technical accounts with high privileges on servers using OpenID Connect (OIDC) as an authentication method, and can also allow to avoid the multifactor authentication requirement in these scenarios.

The problem, discovered and explained by Horizon3.ai researchers, lies in the incorrect validation of the identity assertions received from the OIDC supplier: when a SpleHelp server is configured to delegate authentication via OIDC and certain group options are enabled, a remote actor can induce the system to log and log in as a new technician without going through MFA. That technician, by default, can perform sensitive activities such as remote control of managed endpoints, execution of scripts and configuration changes, which transforms a ghost account into a powerful input door within the affected network. More technical details and published indicators are available in the Horizon3.ai report Here..

SimpleHelp published patches on June 9, with versions 5.5.16 and 6.0RC2 that correct vulnerability; the manufacturer's official page documents the update and supplier's recommendations in this statement. The NVD classifies the failure as CVE-2026-48558 and marked it with critical severity, so updates should be considered priority in affected environments: more technical information is available at the NVD entry Here..

Not all SpleHelp deployments are vulnerable: the operation requires OIDC to be activated, there is at least one group of technicians linked to the OIDC supplier and the "Allow group authored login" option is activated in that group. Public telemetry data suggest that there are thousands of exposed instances of the product and that a fraction of them use OIDC; therefore it is important to check their own configuration even if the absolute number of servers affected is limited.

From the point of view of operational risk, the ability to create privileged technical accounts in a remote management tool is particularly dangerous. An attacker with these credentials can move laterally, install backdoors in managed endpoints, extract data or compromise customer systems if they are suppliers that use SimpleHelp to support. Although neither SpleHelp nor Horizon3.ai has so far reported active exploitation, the existence of an explosion with direct impact on MFA makes this vulnerability an attractive target for adversaries with an interest in persistent access and escalation.

The immediate actions recommended are clear: update to corrected versions(5.5.16 or 6.0RC2) as soon as possible. If it is not possible for operational restrictions to apply the patch immediately, implement compensatory mitigation: it restricts access to the administration interfaces by IP access control lists, consider temporarily disabling the OIDC delegation or disable the "Find group authored login" option in the technical groups until the system is patched.

In parallel to the application of patches or mitigations, carry out searches and internal research: review the SpleHelp logs in / opt / SpleHelp / logs / server.log and in the subdirectories with time marks to detect records of new technical inscriptions, suspicious mail addresses or unexpected configuration changes. Find recent technical accounts with unknown names or emails and be sure to revoke any session or key you cannot justify. Horizon3.ai published compromise indicators useful for this verification in its disclosure.

It is also prudent to treat each public installation as at greater risk: if your SpleHelp instance is accessible from the Internet, isolate it behind a VPN or administration bastion and apply network segmentation significantly reduces the attack surface. Behavior-based detection for tracking unusual remote connections to endpoints managed by SimpleHelp and validating that the SIEM / EDR records collect relevant access events and administrative changes.

Finally, take organizational measures: coordinate with the identity team (IDP) to audit OIDC assertions and mappings between IDP groups and internal groups, require regular registration and review of privileged accounts and update incident response procedures to consider unauthorized access to remote management tools. The combination of parking, access restrictions, monitoring and audit reduces both the probability and the impact of a successful operation.

If you need evidence of exposure to prioritize actions, public asset search services such as Shodan can give an idea of the number of visible instances, and the manufacturer and researchers maintain the guides and IOCs that should be incorporated into their response playbook. The remediation window is short: update today and audit your OIDC configuration to prevent an automatic creation technique from becoming the pivot of a major intrusion.