CVE-2023-40356

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2023-40702

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

CVE-2023-40356

Affected software: PingOne MFA Integration Kit. Vulnerability: a flaw in the MFA setup prompt could allow pairing a new MFA device with a target user without requiring second‑factor authentication from the user’s existing devices. Root cause / trigger (as stated): may be exploited by a threat act...

CVE-2023-40356 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2023-40356 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2023-40702 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

CVE-2023-40702 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

CVE-2023-40702

CVE-2023-40702 affects PingOne MFA Integration Kit (Ping Identity). The vulnerability arises from misconfiguration of the skipMFA action, allowing a bypass of second-factor authentication so a threat actor with knowledge of a target user’s first-factor credentials can authenticate as that user. R...

Ping Identity PingFederate PingOne MFA Integration Kit Security Vulnerability

Ping Identity PingFederate PingOne MFA Integration Kit is from Ping Identity This integration kit allows PingFederate to use the PingOne MFA service for multi-factor authentication MFA. A security vulnerability exists in Ping Identity PingFederate PingOne MFA Integration Kit versions prior to...

CVE-2023-40702: Authentication Bypass by Spoofing

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

PT-2024-12888

Name of the Vulnerable Software and Affected Versions PingOne MFA Integration Kit affected versions not specified Description The issue is related to the Prompt Users to Set Up MFA configuration in the PingOne MFA Integration Kit. Under certain conditions, this configuration could allow for a new...

PT-2024-12909

Name of the Vulnerable Software and Affected Versions PingOne MFA Integration Kit affected versions not specified Description The issue allows the skipMFA action to be configured in a way that user authentication does not require the second factor authentication from the user's existing registere...

CVE-2023-40356: Authentication Bypass by Spoofing

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

Authy phone numbers accessed by cybercriminals, warns Twilio

Twilio has warned users of the Authy multi-factor authentication MFA app about an incident in which cybercriminals may have obtained their phone numbers. Twilio said the cybercriminals abused an unsecured Application Programming Interface API endpoint to verify the phone numbers of millions of...

How MFA Failures are Fueling a 500% Surge in Ransomware Losses

The cybersecurity threat landscape has witnessed a dramatic and alarming rise in the average ransomware payment, an increase exceeding 500%. Sophos, a global leader in cybersecurity, revealed in its annual "State of Ransomware 2024" report that the average ransom payment has increased 500% in the...

Improper Authentication

Firefly III is vulnerable to an Improper Authentication. The vulnerability is due to a flaw in the Firefly III OAuth flow, which may allow malicious users to bypass the MFA check, enabling them to gain access using passwords stolen from other sources through password spraying...

GHSA-4GM4-C4MH-4P7W Firefly III has a MFA bypass in oauth flow

Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an...

Firefly III has a MFA bypass in oauth flow

Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an...

CVE-2024-37893

Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...

CVE-2024-37893

Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to Firefly III data using passwords stolen from...