The MFA Bypass Nobody Saw: How Attackers Walked Past Two-Factor on 14,000 Servers

A critical flaw in SimpleHelp let attackers skip multi-factor authentication entirely, not by cracking it, but by enrolling their own. It is being used right now to steal passwords, tokens, and keys. Here is what happened, and what it teaches the rest of us about trusting a single lock.

What happened

Multi-factor authentication is supposed to be the safety net. Even if someone steals your password, the reasoning goes, they still cannot get in without your second factor. That assumption just failed in public, on roughly 14,000 servers, and attackers are actively using the gap to steal credentials.

The vulnerability is CVE-2026-48558, a critical flaw in SimpleHelp, a remote support tool used by thousands of managed service providers and internal IT teams to reach computers across Windows, macOS, and Linux. CISA rated it critical and added it to its Known Exploited Vulnerabilities catalog on June 29, 2026, with a federal patch deadline of July 2. That deadline has now passed. Any server still unpatched is both out of compliance and, according to security researchers, actively targeted.

What actually went wrong

SimpleHelp can hand off login to an outside identity provider using a standard called OpenID Connect, the same technology behind most "sign in with your company account" buttons. When it works, the identity provider vouches for you with a digital token, and the application trusts that token.

The flaw was simple in the worst way: SimpleHelp accepted those tokens without checking their cryptographic signature. The signature is the part that proves a token is genuine and was not tampered with. Skipping that check is like a bouncer accepting an ID without ever looking at whether it is real. The vulnerability class has a formal name, CWE-347, "improper verification of a cryptographic signature," and the practical result is that the server believed an identity claim it should have rejected.

The outcome is a fully privileged technician account, created by an outsider, with the ability to reach and control every managed computer. This post intentionally stops at the "what," not the "how": there are no exploitation steps here, because none are needed to understand your risk or fix it.

Why the MFA did not help

This is the part worth sitting with, because it is the lesson that reaches beyond SimpleHelp. Many of these servers required multi-factor authentication for technicians. It did not matter. When a new technician account logs in for the first time, it gets to register its own second factor. So the attacker, having reached a brand-new account, simply enrolled their own MFA device and satisfied the requirement.

The second factor was never broken. It was sidestepped. The lock was fine; the attacker was handed the authority to install a new lock of their own choosing. That distinction matters, because it is the pattern behind a growing share of real-world breaches: not cracked encryption, but broken trust in how identity gets verified. If you want the plain-English version of why "MFA" and "2FA" are not magic words, our 2FA vs MFA guide breaks it down, and the recent Microsoft MFA outage is another reminder that MFA is a layer, not a wall.

Are you affected?

Only servers with OpenID Connect configured a specific way are exposed. Here is the quick read on configuration:

And here is the version picture, straight from the vendor advisory:

At disclosure, researchers found roughly 14,000 SimpleHelp servers exposed to the internet, and a meaningful share of a sampled set were running the vulnerable OIDC configuration.

What attackers are doing with it

This is not theoretical. Researchers have tied active exploitation to the delivery of infostealer malware, software whose entire job is to harvest credentials. Once inside, the goal is not just the SimpleHelp server. It is the reachable systems beyond it: saved browser passwords, SSH keys, cloud access keys, source-control sessions, and API tokens.

That last point is the quiet danger. A stolen cloud key or publishing token can outlive the original break-in. Even after the compromised machine is cleaned, an attacker holding those secrets can walk back in through trusted services, because the credentials themselves still work. The malware was the door. The stolen credentials are the copied key, and those keys are exactly what feed the giant credential dumps we keep writing about, like the so-called 16 billion password leak.

What to do right now

If you or your IT provider runs SimpleHelp, the actions are clear and urgent.

1. Patch immediately. Upgrade to SimpleHelp 5.5.16 or 6.0 RC2. Versions 5.5.15 and earlier, and all 6.0 pre-release builds, are affected.
2. If you cannot patch this minute, disable OIDC login or restrict technician authentication to approved IP addresses under Administration then Login Security, and take the server off the public internet until it is patched.
3. Audit your technician accounts. In Administration then Technicians, enable "Show Group Authenticated Users" and look for any unfamiliar names or email addresses that appeared recently. A rogue technician account is the fingerprint of this attack.
4. Assume credential exposure if you were exposed. If a vulnerable server was internet-facing, treat reachable secrets as potentially stolen and rotate them in order of blast radius: any shared admin passwords first, then cloud and API keys, SSH keys, and source-control tokens.
5. If you rely on a managed service provider, ask them directly whether they run SimpleHelp and whether they have patched. Their exposure is your exposure.

The lesson for the rest of us

Most people reading this do not run SimpleHelp. The reason it still matters is the shape of the failure. This was not a weak password or a cracked algorithm. It was software trusting an identity claim it should have verified, and an attacker turning that trust into stolen credentials.

You cannot patch someone else's server. What you can control is how much a single stolen credential is worth. The whole endgame of this attack was harvesting passwords and keys and reusing them elsewhere, and that only works when the same credentials open more than one door. A unique, strong password on every account means a credential stolen from one place is useless everywhere else. That is the difference between a bad day and a chain reaction.

The practical version of that is a password manager. It generates a different strong password for every login and remembers them so you do not have to, which is what actually ends the password reuse that turns one breach into many. You can check how exposed your current password is, generate a strong replacement in a couple of minutes, and confirm it clears the length that actually holds up in 2026.

Indicators of compromise

If you are investigating a possibly affected server, look for:

• Unfamiliar technician accounts, especially group-authenticated ones created recently (Administration then Technicians then "Show Group Authenticated Users").
• Unexpected OIDC login activity or configuration changes outside your normal patterns in SimpleHelp server logs. Note that these logs may not be forwarded to external monitoring by default.
• A loader disguised as a common web asset (reported masquerading as jquery.js) and follow-on infostealer behavior on managed endpoints.
• Signs of credential theft on reachable systems: unexpected access to cloud consoles, source control, or SSH from new locations.

Because the follow-on goal is credential theft, treat containment as incomplete until exposed secrets are rotated, not just when the malware is removed.

Sources: CISA Known Exploited Vulnerabilities catalog, NVD CVE-2026-48558, and vulnerability research from Horizon3.ai (the disclosing researchers), Arctic Wolf, Help Net Security, and SOCRadar. Verified July 5, 2026. This post intentionally omits exploitation details.