CVE-2022-40722: Pingidentity Pingfederate

Medium severity, CVSS 5.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

Affected products

• Pingidentity Pingfederate: from 11.1.0, up to and including 11.1.5; from 11.2.0, up to and including 11.2.2
• Pingidentity Pingid Adapter For Pingfederate: before 2.13.2 (fixed in 2.13.2)
• Pingidentity Pingid Integration Kit: before 2.24 (fixed in 2.24)

Published 2023-04-25. Last modified 2026-06-17.