CVE-2022-23724

Description

Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials.

Weakness classification

• CWE-288: Authentication Bypass Using an Alternate Path or Channel
• CWE-798: Use of Hard-coded Credentials

Primary references

• responsible-disclosure@pingidentity.com — Vendor Advisory
• responsible-disclosure@pingidentity.com — Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory