PingFederate and PingAccess
CVE-2022-23722: PingFederate Password Reset via Authentication API Mishandling
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityUnknown
EPSS0.61%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PingFederate 11.0 to 11.0 | Upgrade past 11.0; see the advisory |
| PingFederate 10.3 to 10.3.4 | Upgrade past 10.3.4; see the advisory |
| PingFederate 10.2 to 10.2.7 | Upgrade past 10.2.7; see the advisory |
| PingFederate 10.1 to 10.1.9 | Upgrade past 10.1.9; see the advisory |
| PingFederate 10.0 to 10.0.12 | Upgrade past 10.0.12; see the advisory |
| PingFederate 9.3 to 9.3.3P16 | Upgrade past 9.3.3P16; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.