{"id":"CVE-2022-40722","aliases":["EUVD-2022-43991","GHSA-7qpc-pm8w-mgv5"],"status":"published","title":"Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.","description":"A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00328,"percentile":0.26082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-327","CWE-780"],"published":"2023-04-25T00:00:00Z","modified":"2026-06-17T05:01:54Z","products":[{"vendor":"ping identity","product":"pingfederate (includes pingid adapter)"},{"vendor":"ping identity","product":"pingid adapter for pingfederate"},{"vendor":"ping identity","product":"pingid integration kit (includes pingid adapter)"},{"vendor":"pingidentity","product":"pingfederate"},{"vendor":"pingidentity","product":"pingid_adapter_for_pingfederate"},{"vendor":"pingidentity","product":"pingid_integration_kit"}],"references":[{"url":"https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_20_rn","tags":["x_transferred","Release Notes"]},{"url":"https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa","tags":["x_transferred","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40722"},{"url":"https://github.com/advisories/GHSA-7qpc-pm8w-mgv5"}],"sources":{"cve":[{"id":"CVE-2022-40722","title":"Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.","description":"A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2025-02-04T14:49:20.723Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-780"],"updated_at":"2026-11-02T14:34:30.493103Z"}],"euvd":[{"id":"EUVD-2022-43991","description":"A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.","status":"published","published":"2023-04-25T00:00:00Z","modified":"2025-02-04T14:49:20Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:06.761301Z"}],"ghsa":[{"id":"GHSA-7qpc-pm8w-mgv5","title":"A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support...","description":"A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.","status":"published","published":"2023-04-25T21:30:28Z","modified":"2024-04-04T03:41:00Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-327","CWE-780"],"updated_at":"2026-11-02T14:56:17.471503Z"}],"nvd":[{"id":"CVE-2022-40722","description":"A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.","status":"published","published":"2023-04-25T19:15:10.24Z","modified":"2026-06-17T05:01:54.8Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-780","CWE-327"],"updated_at":"2026-11-02T14:07:37.42466Z"}]}}