CVE-2023-40545: PingFederate OAuth client_secret_jwt Authentication Bypass
Published Feb 6, 2024
·Updated
Authentication bypass when an OAuth2 Client is using clientsecretjwt as its authentication method on affected 11.3 versions via specially crafted requests.
Affected Software
1 affected component
pingidentity Pingfederate=11.3.0
Event History
Feb 6, 2024
CVE Published
via MITRE·05:27 PM
Data Sourced
via MITRE·05:27 PM
DescriptionSeverityWeakness
Aug 25, 56091
Event
via NVD·11:45 PM
Frequently Asked Questions
1
What is the severity of CVE-2023-40545?
CVE-2023-40545 is classified as a critical severity vulnerability due to its potential for authentication bypass.
2
How do I fix CVE-2023-40545?
To fix CVE-2023-40545, update PingFederate to a version that is not affected by this vulnerability.
3
What versions of PingFederate are affected by CVE-2023-40545?
CVE-2023-40545 affects PingFederate version 11.3.0.
4
What type of vulnerability is CVE-2023-40545?
CVE-2023-40545 is an authentication bypass vulnerability when using the client_secret_jwt authentication method.
5
Who is at risk for CVE-2023-40545?
Organizations using PingFederate version 11.3.0 with OAuth2 client_secret_jwt for authentication are at risk for CVE-2023-40545.