← Database

CVE-2022-23722

MEDIUM CVSS: 6.5 Published: 2022-05-02 Modified: 2026-06-17

Description

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

Affected Platforms

Pingidentity Pingfederate

Weakness Type

CWE-288, CWE-287

References