TI-2023-21185 Aliases CVE-2023-40356 GHSA-5hj4-9975-4r5m

PingOne MFA Integration Kit MFA bypass

MEDIUM 40CWE-290Published 2024-07-09 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s existing registered devices. A threat actor might be able to exploit this vulnerability to register their own MFA device with a target user’s account if they have existing knowledge of the target user’s first factor credential.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00401 34th percentileScored 2026-11-07

Fix Fixed PingOne MFA Integration Kit for PingFederate (Ping Identity): 2.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Ping Identity	PingOne MFA Integration Kit for PingFederate	before 2.3.1	2.3.1	Patch available	CNA

PingOne MFA Integration Kit for PingFederate VendorPing Identity Affected before 2.3.1 Fixed in 2.3.1 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pingone:pingone_mfa_intergration_kit_for_pingfederate::::::::	—	—	—

cpe:2.3:a:pingone:pingone_mfa_intergration_kit_for_pingfederate:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA PingOne MFA Integration Kit for PingFederate (Ping Identity) Fixed in 2.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-07-09
Ping Identity PingOne MFA Integration Kit for PingFederate 2.3.1
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-21487 PingOne MFA Integration Kit MFA bypassPriority LOW 36
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-40356
2026-10-03 Alias added: GHSA-5hj4-9975-4r5m

References

Other 1

https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394

TI-2018-15786 UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to… CVSS 3.0CRITICAL 9.8
TI-2020-08561 Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled… CVSS 3.1CRITICAL 9.8
TI-2025-14368 PingAM Java Policy Agent path traversal CVSS 4.0CRITICAL 9.2
TI-2023-21350 PingFederate OAuth client_secret_jwt Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2026-17292 Improper Claim Validation in PingAM OIDC Provider CVSS 4.0CRITICAL 9.5
TI-2023-20828 PingFederate PingID Radius PCV Authentication Bypass CVSS 3.1CRITICAL 9.8

See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences