title: PingFederate Password Reset via Authentication API Mishandling
description: When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
problem types: CWE-288 Authentication Bypass Using an Alternate Path or Channel
affected:
{
product: PingFederate
vendor: Ping Identity
versions:
lessThanOrEqual: 11.0, status: affected, version: 11.0, versionType: custom
lessThanOrEqual: 10.3.4, status: affected, version: 10.3, versionType: custom
lessThanOrEqual: 10.2.7, status: affected, version: 10.2, versionType: custom
lessThanOrEqual: 10.1.9, status: affected, version: 10.1, versionType: custom
lessThanOrEqual: 10.0.12, status: affected, version: 10.0, versionType: custom
lessThanOrEqual: 9.3.3P16, status: affected, version: 9.3, versionType: custom
}