PingOne MFA Integration Kit MFA bypass

CVE-2023-40702

What is CVE-2023-40702?

The PingOne MFA Integration Kit has been identified to contain a vulnerability related to its skipMFA feature. This misconfiguration allows user authentication to occur without necessitating second factor verification from previously registered devices. Consequently, threat actors with knowledge of a user's first-factor credentials can potentially exploit this configuration flaw, enabling them to authenticate as the target user without proper authorization. This vulnerability presents significant risks to user accounts and overall security posture.

References