Configuration-based MFA Bypass in PingID RADIUS PCV.
Priority LOW 29CWE-305Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed PingID Integration Kit (includes Radius PCV) (Ping Identity): 2.24
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ping Identity | PingID Radius PCV | 2.10.0; 3.0.0 and later; 3.0.2 – 3.0.2 | — | No fix listed | CNA |
| Ping Identity | PingID Integration Kit (includes Radius PCV) | 2.24 to before 2.24 | 2.24 | Patch available | CNA |
| Ping Identity | PingFederate (includes Radius PCV) | 11.1.0 and later; 11.1.5 – 11.1.5; 11.2.0 and later; 11.2.2 – 11.2.2 | — | No fix listed | CNA |
- PingID Radius PCV VendorPing Identity Affected 2.10.0; 3.0.0 and later; 3.0.2 – 3.0.2 Fixed in — No fix listed CNA
- PingID Integration Kit (includes Radius PCV) VendorPing Identity Affected 2.24 to before 2.24 Fixed in 2.24 Patch available CNA
- PingFederate (includes Radius PCV) VendorPing Identity Affected 11.1.0 and later; 11.1.5 – 11.1.5; 11.2.0 and later; 11.2.2 – 11.2.2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* | 11.1.0 – 11.1.5; 11.2.0 – 11.2.2 | Vulnerable | Ping Identity |
| cpe:2.3:a:pingidentity:pingid_integration_kit:*:*:*:*:*:*:*:* | before 2.24 | Vulnerable | Ping Identity |
| cpe:2.3:a:pingidentity:radius_pcv:*:*:*:*:*:*:*:* | 3.0.0 to before 3.0.2 | Vulnerable | Ping Identity |
| cpe:2.3:a:pingidentity:radius_pcv:2.10.0:*:*:*:*:*:*:* | 2.10.0 | Vulnerable | Ping Identity |
- cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* Versions 11.1.0 – 11.1.5; 11.2.0 – 11.2.2 Vulnerable ·Ping Identity
- cpe:2.3:a:pingidentity:pingid_integration_kit:*:*:*:*:*:*:*:* Versions before 2.24 Vulnerable ·Ping Identity
- cpe:2.3:a:pingidentity:radius_pcv:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.2 Vulnerable ·Ping Identity
- cpe:2.3:a:pingidentity:radius_pcv:2.10.0:*:*:*:*:*:*:* Versions 2.10.0 Vulnerable ·Ping Identity
Remediation
- Fix · CNA PingID Integration Kit (includes Radius PCV) (Ping Identity) Fixed in 2.24
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40723
- 2026-10-03 Alias added: GHSA-5hwc-8c64-25vm
More Ping Identity Pingfederate vulnerabilities
- TI-2023-21350 PingFederate OAuth client_secret_jwt Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2023-18913 Authentication Bypass via HTML Form & Identifier First Adapter CVSS 3.1CRITICAL 9.8
- TI-2021-17402 The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain… CVSS 3.1CRITICAL 9.8
- TI-2022-19358 Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. CVSS 3.1HIGH 8.8
- TI-2023-20377 Admin Console Denial of Service via Java class enumeration CVSS 3.1HIGH 7.5
- TI-2022-19356 Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. CVSS 3.1HIGH 7.7
Sources
- CVE-2022-40723 · CVE Program
- CVE-2022-40723 · NVD
- FIRST EPSS
- GHSA-5hwc-8c64-25vm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences