CVE-2023-39231 — PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor…
Published: 2023-10-24 · CVSS: 7.3 · CVSS 3.1
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7