CVE-2023-40545
PingFederate OAuth client_secret_jwt Authentication Bypass
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
Omisión de autenticación cuando un cliente OAuth2 utiliza client_secret_jwt como método de autenticación en las versiones 11.3 afectadas a través de solicitudes especialmente manipuladas.
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-08-25 CVE Reserved
- 2024-02-06 CVE Published
- 2024-08-22 CVE Updated
- 2025-04-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-306: Missing Authentication for Critical Function
CAPEC
- CAPEC-115: Authentication Bypass
References (2)
| URL | Tag | Source |
|---|---|---|
| https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 | Release Notes | |
| https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html | Release Notes |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Pingidentity Search vendor "Pingidentity" | Pingfederate Search vendor "Pingidentity" for product "Pingfederate" | 11.3.0 Search vendor "Pingidentity" for product "Pingfederate" and version "11.3.0" | - |
Affected
| ||||||