PingFederate and PingAccess
CVE-2022-40722: Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PingID Adapter for PingFederate 2.13 | 2.13.2 or later |
| PingID Integration Kit (includes PingID Adapter) 2.24 | 2.24 or later |
| PingFederate (includes PingID Adapter) 11.1 | 11.1.0* or later |
| PingFederate (includes PingID Adapter) 11.1.5 to 11.1.5 | Upgrade past 11.1.5; see the advisory |
| PingFederate (includes PingID Adapter) 11.2 | 11.2.0* or later |
| PingFederate (includes PingID Adapter) 11.2.2 to 11.2.2 | Upgrade past 11.2.2; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.