PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user’s first-factor credentials.

N/A

使用欺骗进行的认证绕过

Ping Identity PingFederate PingOne MFA Integration Kit 安全漏洞

Ping Identity PingFederate PingOne MFA Integration Kit是Ping Identity的该集成工具包允许PingFederate使用 PingOne MFA服务进行多因素身份验证 (MFA)。 Ping Identity PingFederate PingOne MFA Integration Kit 2.3.1之前版本存在安全漏洞，该漏洞源于通过配置skipMFA操作可以使用目标用户的身份进行身份验证。

N/A

N/A