← Back

CVE-2021-41994

nvd nist
Published: Apr 30, 2022Modified: Jun 17, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Exploitability: 0.4 / Impact: 4.0
Source: NVD

Description

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

Affected (2)

Pingidentity
2 products
Pingid
Pingid Windows Login
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Pingid
Before 1.19
Pingid Windows Login
All versions

Related CWEs

CWE-310
CWE-310
CWE-330
Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (4)

Source: responsible-disclosure@pingidentity.com
PatchRelease NotesVendor Advisory
Source: responsible-disclosure@pingidentity.com
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
PatchRelease NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch

Timeline

No history available yet.