What’s Vulnerable › Vulnerabilities

CVE-2022-40722: Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-25 · updated 2026-06-17
• Weakness: CWE-780

Description

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

Affected products

• Ping Identity PingFederate: from 11.1.0 through 11.1.5; from 11.2.0 through 11.2.2
• Ping Identity PingID Adapter for PingFederate: before 2.13.2 — fixed in 2.13.2
• Pingidentity Pingid Integration Kit: before 2.24 — fixed in 2.24

How to fix

Upgrade to a fixed version: Ping Identity PingID Adapter for PingFederate 2.13.2; Pingidentity Pingid Integration Kit 2.24. Check the vendor advisory for mitigations.

References

• https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
• https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn
• https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa
• https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn

Get alerted when CVE-2022-40722 or the next vulnerability affects your stack