CVE-2026-48558: SimpleHelp OIDC Auth Bypass Used to Deploy Infostealer Payloads

CVE-2026-48558 is a critical OIDC authentication bypass in SimpleHelp that allows attackers to forge identity tokens and obtain technician sessions; active exploitation has been observed delivering infostealers (Djinn Stealer) via an obfuscated Node.js loader (TaskWeaver). The report lists affected versions (5.5.1–5.5.15, pre-6.0 builds prior to 6.0 RC2), recommended upgrades (5.5.16+, 6.0 RC2+/public 6.0+), mitigation/hunt steps, and notes CISA added the vulnerability to the KEV catalog with a July 2, 2026 remediation deadline.