CVE-2023-39231 (published 2023-10-24T19:56:06.690Z)
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.
Affected products: Vendor: Ping Identity
Product: PingOne MFA Integration Kit
Versions: 2.2