The US cybersecurity agency CISA added an authentication bypass vulnerability, CVE-2026-48558, to its Known Exploited Vulnerabilities (KEV) catalog on Monday. The agency urged federal agencies to patch the vulnerability within three days, following BOD 26-04 guidance.

This vulnerability, which affects SimpleHelp remote monitoring and management (RMM) software, has been exploited for malware delivery. The bug impacts SimpleHelp's OpenID Connect (OIDC) authentication flow and has a CVSS score of 10. The issue arises because the application does not verify the cryptographic signature of identity tokens when OIDC authentication is configured.

A remote attacker can exploit this flaw by submitting a forged token during login to obtain a fully authenticated technician session. If an attacker gains access to an internet-facing SimpleHelp server, they can transfer files and execute commands on all systems managed through that server.

Blackpoint, a cybersecurity firm, observed an attack where this access was used to deploy TaskWeaver and Djinn Stealer malware. TaskWeaver is a Node.js loader, while Djinn Stealer is a cross-platform information stealer. Blackpoint said that TaskWeaver was used to perform system fingerprinting and to deploy a JavaScript payload that executed with full Node.js access. "TaskWeaver has a simple structure and can be used to deploy any encrypted payload," Blackpoint stated.

Djinn Stealer is designed to steal various secrets from developer machines, including cloud credentials, SSH keys, infrastructure configurations, source control tokens, package registry authentication, development tooling, cryptocurrency wallets, and browser data. The security defect was addressed in late May in SimpleHelp versions 5.5.16 and 6.0 RC2. Blackpoint noted that it specifically takes credentials for artificial intelligence development tools. "Most notably, it takes the credentials for AI development tools, giving an attacker a foothold to tamper with the very pipelines teams are building on," Blackpoint said.