Description
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ping Identity | PingFederate | 11.0 – ≤ 11.0, 10.3 – ≤ 10.3.4, 10.2 – ≤ 10.2.7, 10.1 – ≤ 10.1.9, 10.0 – ≤ 10.0.12, 9.3 – ≤ 9.3.3P16 | — |