SimpleHelp OIDC Bypass Fuels Deployment of TaskWeaver Loader and Djinn Credential Stealer
A critical authentication bypass (CVE-2026-48558) in SimpleHelp's OIDC flow lets an unauthenticated attacker impersonate a technician and run commands on managed endpoints. Blackpoint observed the flaw being used to drop TaskWeaver, a Node.js loader, and Djinn Stealer, which exfiltrates developer credentials. CISA has added the bug to its KEV catalog, urging immediate patching.