CVE-2022-23723

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.

Score

CVSS 3.1 7.7 High

Status

Modified - responsible-disclosure@pingidentity.com

Published

2022-05-02

Last modified

2024-08-03

Weaknesses

CWE-287, CWE-288

Affected products

• Pingfederate Pingone Mfa Integration Kit (Ping Identity)
• Pingone Mfa Integration Kit (Pingidentity)

References

• https://docs.pingidentity.com/bundle/pingfederate-pingone-mfa-ik/page/wpt1599064234202.html
• https://www.pingidentity.com/en/resources/downloads/pingfederate.html