What’s Vulnerable › Vulnerabilities

CVE-2023-39231: PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-25 · updated 2026-06-17
• Weakness: CWE-288

Description

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.

Affected products

• Ping Identity PingFederate PingOne MFA Integration Kit: 2.2

References

• https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394
• https://www.pingidentity.com/en/resources/downloads/pingid.html
• https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394
• https://www.pingidentity.com/en/resources/downloads/pingid.html

Get alerted when CVE-2023-39231 or the next vulnerability affects your stack