CVE-2023-39231 PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's...

CVE-2023-39231

CVE-2023-39231 affects PingFederate with the PingOne MFA adapter, where a threat actor who knows a victim’s first-factor credentials can pair a new MFA device without second-factor authentication. Core impact is unauthorized MFA enrollment, risking account compromise. Affected product/adapter and...

CVE-2023-39231 PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's...

PT-2023-27162 · Ping Identity · Pingfederate

Name of the Vulnerable Software and Affected Versions: PingFederate with PingID Radius PCV affected versions not specified Description: A first-factor authentication bypass issue exists when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request. This allows for...

PT-2023-26844 · Unknown · Pingfederate

Name of the Vulnerable Software and Affected Versions: PingFederate affected versions not specified Description: The issue allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this to register...

CVE-2022-40724

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery CSRF through crafted GET requests...

CVE-2022-40723

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations...

CVE-2022-40724

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery CSRF through crafted GET requests...

CVE-2022-40722

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA...

CVE-2022-40723

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations...

Authentication flaw

The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations...

Cross site request forgery (csrf)

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery CSRF through crafted GET requests...

Design/Logic Flaw

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA...

CVE-2022-40723

The CVE-2022-40723 entry concerns the PingID RADIUS PCV adapter for PingFederate. Reports in connected sources confirm a configuration-based MFA bypass vulnerability in this component (PingID RADIUS PCV adapter) with no explicit affected version ranges provided. Documented impact is MFA bypass un...

CVE-2022-40722 Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA...

PT-2023-13898 · Ping Identity · Pingid Radius Pcv Adapter

Name of the Vulnerable Software and Affected Versions: PingID RADIUS PCV adapter for PingFederate affected versions not specified Description: The issue concerns a bypass of multi-factor authentication MFA under certain configurations. It affects the PingID RADIUS PCV adapter for PingFederate,...

PT-2023-13897 · Ping Identity · Pingid Adapter For Pingfederate

Name of the Vulnerable Software and Affected Versions: PingID Adapter for PingFederate affected versions not specified Description: A misconfiguration of RSA padding in the PingID Adapter for PingFederate, used to support Offline MFA with PingID mobile authenticators, makes it vulnerable to...

CVE-2022-40724 Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery CSRF through crafted GET requests...

CVE-2022-40722

CVE-2022-40722 concerns a misconfiguration of RSA padding in the PingID Adapter for PingFederate used to support Offline MFA with PingID mobile authenticators. Red Hat, NVD, CNNVD and other sources describe that this faulty padding enables pre-computed dictionary attacks that bypass offline MFA. ...

CVE-2022-40724 Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery CSRF through crafted GET requests...