CVE-2021-41994

MEDIUM 4.8CVE-2021-41994 · Published 30/04/2022 · updated 17/06/2026

In short

CVE-2021-41994 is a MEDIUM (CVSS 4.8) vulnerability affecting pingid (pingidentity).
Chance of exploitation in the next 30 days (EPSS): 0.24%, higher than 15.2% of all vulnerabilities.
Fix: update to 1.19 or later.

Package	Affected versions	Patched versions
pingid pingidentity	`< 1.19`	`1.19`

Description

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

References

docs.pingidentity.com/bundle/pingid/page/ejd1642076304199.html · Patch
pingidentity.com/en/resources/downloads/pingid.html · Patch

More vulnerabilities in pingid

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free