Access Control Vulnerability in PingIDM Affects Client Mode Configuration

CVE-2025-20628

What is CVE-2025-20628?

PingIDM, previously known as ForgeRock Identity Management, has a vulnerability that stems from insufficient granularity of access control. Administrators face challenges when configuring access rules for Remote Connector Servers (RCS) operating in client mode. This vulnerability allows attackers to potentially spoof an RCS, enabling them to intercept or modify critical identity-related information, including passwords and account recovery data. Exploitation is possible only if the RCS is specifically set to operate in client mode.

References