CVE-2023-40356 | BDVDB-2026-241682 Detail

Description#

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s existing registered devices. A threat actor might be able to exploit this vulnerability to register their own MFA device with a target user’s account if they have existing knowledge of the target user’s first factor credential.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12024-07-09Record published in the CVE List.
2. Version 22024-08-02Most recent update recorded in the CVE List.