High Confidence SimpleHelp OIDC Forged Token Authentication Bypass - STRICT
SIGMA detection rule by Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a · Unknown
Detects SimpleHelp OIDC authentication attempts using unsigned, unverified, or signature-failed tokens consistent with CVE-2026-48558 exploitation, including JSON-encoded tokens and Base64URL algorithm casing variants. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte les tentatives d'authentification OIDC SimpleHelp utilisant un jeton non signe, non verifie ou avec echec de signature, coherentes avec l'exploitation de CVE-2026-48558. Couvre les jetons en format form-encoded et JSON body, ainsi que les variantes de casse de l'algorithme alg:none (none, None, NONE). Permet la detection par champs enrichis (JwtAlgorithm, TokenSignatureVerified) meme en l'absence de corps de requete journalise par le reverse proxy. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
title: High Confidence SimpleHelp OIDC Forged Token Authentication Bypass - STRICT
id: 7e1b9dc6-79ab-4c37-aeb5-cd28b8666fc5
status: experimental
description: |
Detects SimpleHelp OIDC authentication attempts using unsigned, unverified, or signature-failed tokens consistent with CVE-2026-48558 exploitation, including JSON-encoded tokens and Base64URL algorithm casing variants. SOC L1 should verify the source, affected host, user, process or request fields, timing, and related activity.
Detecte les tentatives d'authentification OIDC SimpleHelp utilisant un jeton non signe, non verifie ou avec echec de signature, coherentes avec l'exploitation de CVE-2026-48558. Couvre les jetons en format form-encoded et JSON body, ainsi que les variantes de casse de l'algorithme alg:none (none, None, NONE). Permet la detection par champs enrichis (JwtAlgorithm, TokenSignatureVerified) meme en l'absence de corps de requete journalise par le reverse proxy. Le SOC L1 doit vérifier la source, l’hôte affecté, l’utilisateur, les champs de processus ou de requête, la chronologie et les activités associées.
references:
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://simple-help.com/security/simplehelp-security-update-2026-05
- https://nvd.nist.gov/vuln/detail/CVE-2026-48558
- https://www.cve.org/CVERecord?id=CVE-2026-48558
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48558
- https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
- https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/
- https://simple-help.com/release-news
author: Adama ASSIONGBON (SOC & CTI Consultant), https://linkedin.com/in/adama-assiongbon-9029893a
date: 2026-06-30
modified: 2026-07-01
related:
- id: 08c1d2af-f0a2-4b60-8a24-2be9f46764f9
type: derived
logsource:
category: webserver
detection:
selection_simplehelp_oidc_path:
cs-uri-stem|contains:
- '/oidc'
- '/openid'
- '/oauth'
- '/sso'
- '/callback'
selection_token_requestbody:
RequestBody|contains:
- 'id_token='
- 'id_token%3D'
- 'access_token='
- 'client_assertion='
- '"id_token":'
- '"id_token" :'
- '"access_token":'
- '"client_assertion":'
selection_token_http_body:
http.request.body.content|contains:
- 'id_token='
- 'id_token%3D'
- 'access_token='
- 'client_assertion='
- '"id_token":'
- '"id_token" :'
- '"access_token":'
- '"client_assertion":'
selection_token_query:
cs-uri-query|contains:
- 'id_token='
- 'id_token%3D'
- 'access_token='
- 'client_assertion='
selection_jwt_alg_none_body:
RequestBody|contains:
- 'eyJhbGciOiJub25l'
- 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l'
- '"alg":"none"'
- "'alg':'none'"
- 'eyJhbGciOiJOb25lIn0'
- 'eyJhbGciOiJOT05FIn0'
selection_jwt_alg_none_http:
http.request.body.content|contains:
- 'eyJhbGciOiJub25l'
- 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l'
- '"alg":"none"'
- "'alg':'none'"
- 'eyJhbGciOiJOb25lIn0'
- 'eyJhbGciOiJOT05FIn0'
selection_jwt_alg_none_query:
cs-uri-query|contains:
- 'eyJhbGciOiJub25l'
- 'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25l'
- 'eyJhbGciOiJOb25lIn0'
- 'eyJhbGciOiJOT05FIn0'
selection_signature_failed_fields:
SignatureStatus|contains:
- 'invalid'
- 'failed'
- 'unverified'
- 'not verified'
- 'signature bypassed'
selection_signature_failed_alt_fields:
TokenSignatureStatus|contains:
- 'invalid'
- 'failed'
- 'unverified'
- 'not verified'
- 'signature bypassed'
selection_signature_verified_false:
TokenSignatureVerified:
- 'false'
- 'False'
selection_oidc_signature_verified_false:
OidcSignatureVerified:
- 'false'
- 'False'
selection_jwt_algorithm_field:
JwtAlgorithm:
- 'none'
- 'None'
- 'NONE'
filter_main_known_oidc_healthcheck:
c-useragent|contains:
- 'OIDC-HealthCheck'
- 'Synthetic-Monitor'
filter_main_internal_test_idp:
cs-host|contains:
- 'oidc-lab.'
- 'sso-test.'
condition: >
selection_simplehelp_oidc_path
and (
(1 of selection_token_* and 1 of selection_jwt_alg_none_*)
or 1 of selection_signature_failed_*
or selection_jwt_algorithm_field
or selection_signature_verified_false
or selection_oidc_signature_verified_false
)
and not 1 of filter_main_*
fields:
- c-ip
- x-forwarded-for
- cs-host
- cs-method
- cs-uri-stem
- cs-uri-query
- cs-username
- c-useragent
- RequestBody
- http.request.body.content
- JwtAlgorithm
- TokenSignatureVerified
- OidcSignatureVerified
- SignatureStatus
- TokenSignatureStatus
falsepositives:
- Authorized OIDC integration testing in a dedicated lab tenant
- Security scanner validating unsigned JWT rejection with explicit test headers
- Reverse proxy parsing error that incorrectly marks a valid token as unverified
level: high
tags:
- attack.initial-access
- attack.t1190
- attack.t1078
- cve.2026-48558