Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2021-41993: A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
CVE-2021-41993 · published 4 years ago
Summary
A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
What to do
- Update pingidentity pingid to version 1.19 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pingidentity | pingid |
< 1.19 cpe:2.3:a:pingidentity:pingid:*:*:*:*:*:android:*:* |
| pingidentity | pingid_windows_login |
All versions
cpe:2.3:a:pingidentity:pingid_windows_login:-:*:*:*:*:*:*:* |
Original advisory text
A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
References
- https://docs.pingidentity.com/bundle/pingid/page/zvy1641459415679.html Patch Release Notes Vendor Advisory
- https://www.pingidentity.com/en/resources/downloads/pingid.html Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-310Cryptographic Issues
CWE-330Use of Insufficiently Random Values
Timeline
Published30 Apr 2022
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-41993 · NVD
Track software like this
Free during beta