Description
SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| SimpleHelp | SimpleHelp / SimpleHelp | >= 5.5.0, < 5.5.16 | affected |
| SimpleHelp | SimpleHelp / SimpleHelp | >= 6.0, < 6.0 RC2 | affected |