CVE-2022-23723

HIGH 7.7CVE-2022-23723 · Published 02/05/2022 · updated 17/06/2026

In short

CVE-2022-23723 is a HIGH (CVSS 7.7) vulnerability affecting pingone mfa integration kit (pingidentity).
Chance of exploitation in the next 30 days (EPSS): 0.88%, higher than 59.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pingone mfa integration kit pingidentity	`= 1.4= 1.4.1= 1.5= 1.5.1= 1.5.2`	No fix yet

Description

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.

References

docs.pingidentity.com/bundle/pingfederate-pingone-mfa-ik/page/wpt1599064234202.html · Release Notes
pingidentity.com/en/resources/downloads/pingfederate.html · Vendor Advisory

More vulnerabilities in pingone mfa integration kit

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free