OAuth2 Client Authentication Bypass Vulnerability

CVE-2023-40545

What is CVE-2023-40545?

An authentication bypass vulnerability exists in Ping Identity's PingFederate when the OAuth2 Client employs client_secret_jwt as its authentication method. This issue arises specifically in version 11.3, where specially crafted requests can allow unauthorized access to resources. Organizations utilizing affected versions should review their security configurations and implement necessary mitigations to protect against possible exploitation.

References