Description (CNA)
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ping Identity / One-Time Passcode Integration Kit for PingFederate | affected 1.0 through 1.1; unaffected 1.1.1 |
CWE
CWE-306
References
- https://support.pingidentity.com/s/article/SECADV051-PingFederate-OTP-Integration-Kit-authentication-bypass
- https://www.pingidentity.com/en/resources/downloads/pingfederate.html
ADP enrichment
No English description supplied.
No references supplied.