Ping Identity PingFederate OTP Integration Kit Multi-Factor Authentication Bypass Vulnerability

A vulnerability exists in the OTP Integration Kit for PingFederate, where the application improperly validates HTTP methods and authentication states. This flaw allows the server to progress the authentication process without verifying the one-time password (OTP), effectively bypassing multi-factor authentication.

Impact

Exploitation of this vulnerability allows for unauthorized advancement of the authentication state, bypassing multi-factor authentication requirements.

Remediation

Users can download the latest version of PingFederate from the Ping Identity website. For those already using version 12.3, it is recommended to update to the latest maintenance release.