CVE-2022-23722: Pingidentity Pingfederate

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

Affected products

• Pingidentity Pingfederate: from 9.3.0, before 9.3.3 (fixed in 9.3.3); from 10.0.0, before 10.0.12 (fixed in 10.0.12); from 10.1.0, before 10.1.9 (fixed in 10.1.9); from 10.2.0, before 10.2.7 (fixed in 10.2.7); from 10.3.0, before 10.3.4 (fixed in 10.3.4); version 9.3.3 only; …

Published 2022-05-02. Last modified 2026-06-17.