CVE-2025-20628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-20628", "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "state": "PUBLISHED", "assignerShortName": "Ping Identity", "dateReserved": "2025-01-13T16:41:43.939Z", "datePublished": "2026-04-07T22:33:05.356Z", "dateUpdated": "2026-04-08T15:16:29.865Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "shortName": "Ping Identity", "dateUpdated": "2026-04-07T22:33:05.356Z"}, "title": "Insufficient granularity of access control for Remote Connector Servers in client mode", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1220", "description": "CWE-1220 Insufficient Granularity of Access Control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "Ping Identity", "product": "PingIDM", "versions": [{"status": "affected", "version": "7.5.0", "versionType": "custom"}, {"status": "affected", "version": "7.4.0", "lessThanOrEqual": "7.4.1", "versionType": "custom"}, {"status": "affected", "version": "7.3.0", "lessThanOrEqual": "7.3.1", "versionType": "custom"}, {"status": "affected", "version": "7.2.0", "lessThanOrEqual": "7.2.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "7.1.*", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity\u2019s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity\u2019s security-relevant properties, such as passwords and account recovery information. This issue is exploitable <b>only</b> when an RCS is configured to run in client mode."}]}], "references": [{"url": "https://backstage.forgerock.com/knowledge/advisories/article/a14305629?rev=_newest"}, {"url": "https://backstage.pingidentity.com/downloads/browse/idm/featured"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "PRESENT", "Automatable": "YES", "Recovery": "USER", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/S:P/AU:Y/R:U/V:C/RE:M/U:Red"}}], "configurations": [{"lang": "en", "value": "At least one RCS configured in client mode in PingIDM", "supportingMedia": [{"type": "text/html", "base64": false, "value": "At least one RCS configured in client mode in PingIDM<br>"}]}], "workarounds": [{"lang": "en", "value": "Configure a reverse proxy (such as PingGateway) to enforce IP and certificate-based rules to the /openicf\u00a0endpoint.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Configure a reverse proxy (such as PingGateway) to enforce IP and certificate-based rules to the <i>/openicf</i>&nbsp;endpoint.<br>"}]}, {"lang": "en", "value": "Configure all RCS instances to run in server mode.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Configure all RCS instances to run in server mode.<br>"}]}], "solutions": [{"lang": "en", "value": "Both of the following steps are required to mitigate the issue:\n\n * Upgrade to one of the fixed versions listed previously.\n * Secure the /openicf\u00a0endpoint using the new access and authentication configuration options (refer to \u00a0migration dependent features\u00a0 https://docs.pingidentity.com/pingoneaic/latest/product-information/migration-dependent-features.html#current_migration_dependent_features for more details).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Both of the following steps are required to mitigate the issue:</p><ul><li>Upgrade to one of the fixed versions listed previously.</li><li>Secure the <i>/openicf</i>&nbsp;endpoint using the new access and authentication configuration options (refer to<a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.pingidentity.com/pingoneaic/latest/product-information/migration-dependent-features.html#current_migration_dependent_features\">&nbsp;<u>migration dependent features</u>&nbsp;</a>for more details).</li></ul>"}]}], "source": {"defect": ["OPENIDM-20023"], "advisory": "202601", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:16:23.302687Z", "id": "CVE-2025-20628", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:16:29.865Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-20628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T15:16:23.302687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:16:26.667Z"}}], "cna": {"title": "Insufficient granularity of access control for Remote Connector Servers in client mode", "source": {"defect": ["OPENIDM-20023"], "advisory": "202601", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "USER", "baseScore": 6.9, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/S:P/AU:Y/R:U/V:C/RE:M/U:Red", "exploitMaturity": "UNREPORTED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ping Identity", "product": "PingIDM", "versions": [{"status": "affected", "version": "7.5.0", "versionType": "custom"}, {"status": "affected", "version": "7.4.0", "versionType": "custom", "lessThanOrEqual": "7.4.1"}, {"status": "affected", "version": "7.3.0", "versionType": "custom", "lessThanOrEqual": "7.3.1"}, {"status": "affected", "version": "7.2.0", "versionType": "custom", "lessThanOrEqual": "7.2.2"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.1.*"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Both of the following steps are required to mitigate the issue:\n\n * Upgrade to one of the fixed versions listed previously.\n * Secure the /openicf\u00a0endpoint using the new access and authentication configuration options (refer to \u00a0migration dependent features\u00a0 https://docs.pingidentity.com/pingoneaic/latest/product-information/migration-dependent-features.html#current_migration_dependent_features for more details).", "supportingMedia": [{"type": "text/html", "value": "<p>Both of the following steps are required to mitigate the issue:</p><ul><li>Upgrade to one of the fixed versions listed previously.</li><li>Secure the <i>/openicf</i>&nbsp;endpoint using the new access and authentication configuration options (refer to<a target=\"_blank\" rel=\"nofollow\" href=\"https://docs.pingidentity.com/pingoneaic/latest/product-information/migration-dependent-features.html#current_migration_dependent_features\">&nbsp;<u>migration dependent features</u>&nbsp;</a>for more details).</li></ul>", "base64": false}]}], "references": [{"url": "https://backstage.forgerock.com/knowledge/advisories/article/a14305629?rev=_newest"}, {"url": "https://backstage.pingidentity.com/downloads/browse/idm/featured"}], "workarounds": [{"lang": "en", "value": "Configure a reverse proxy (such as PingGateway) to enforce IP and certificate-based rules to the /openicf\u00a0endpoint.", "supportingMedia": [{"type": "text/html", "value": "Configure a reverse proxy (such as PingGateway) to enforce IP and certificate-based rules to the <i>/openicf</i>&nbsp;endpoint.<br>", "base64": false}]}, {"lang": "en", "value": "Configure all RCS instances to run in server mode.", "supportingMedia": [{"type": "text/html", "value": "Configure all RCS instances to run in server mode.<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity\u2019s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.", "supportingMedia": [{"type": "text/html", "value": "An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity\u2019s security-relevant properties, such as passwords and account recovery information. This issue is exploitable <b>only</b> when an RCS is configured to run in client mode.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220 Insufficient Granularity of Access Control"}]}], "configurations": [{"lang": "en", "value": "At least one RCS configured in client mode in PingIDM", "supportingMedia": [{"type": "text/html", "value": "At least one RCS configured in client mode in PingIDM<br>", "base64": false}]}], "providerMetadata": {"orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "shortName": "Ping Identity", "dateUpdated": "2026-04-07T22:33:05.356Z"}}}, "cveMetadata": {"cveId": "CVE-2025-20628", "state": "PUBLISHED", "dateUpdated": "2026-04-08T15:16:29.865Z", "dateReserved": "2025-01-13T16:41:43.939Z", "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "datePublished": "2026-04-07T22:33:05.356Z", "assignerShortName": "Ping Identity"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PingIDM", "vendor": "Ping Identity", "versions": [{"status": "affected", "version": "7.5.0", "versionType": "custom"}, {"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.4.0", "versionType": "custom"}, {"lessThanOrEqual": "7.3.1", "status": "affected", "version": "7.3.0", "versionType": "custom"}, {"lessThanOrEqual": "7.2.2", "status": "affected", "version": "7.2.0", "versionType": "custom"}, {"lessThanOrEqual": "7.1.*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "responsible-disclosure@pingidentity.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity\u2019s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode."}, {"lang": "es", "value": "Una vulnerabilidad de granularidad insuficiente en el control de acceso existe en PingIDM (anteriormente ForgeRock Identity Management) donde los administradores no pueden configurar correctamente las reglas de acceso para los Servidores de Conector Remoto (RCS) que se ejecutan en modo cliente. Esto significa que los atacantes pueden suplantar un RCS en modo cliente (si existe uno) para interceptar y/o modificar las propiedades relevantes para la seguridad de una identidad, como contrase\u00f1as e informaci\u00f3n de recuperaci\u00f3n de cuenta. Este problema es explotable solo cuando un RCS est\u00e1 configurado para ejecutarse en modo cliente."}], "id": "CVE-2025-20628", "lastModified": "2026-07-24T23:10:00.563", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "PRESENT", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "responsible-disclosure@pingidentity.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-20628", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T15:16:23.302687Z", "version": "2.0.3"}}]}, "published": "2026-04-07T23:16:27.040", "references": [{"source": "responsible-disclosure@pingidentity.com", "url": "https://backstage.forgerock.com/knowledge/advisories/article/a14305629?rev=_newest"}, {"source": "responsible-disclosure@pingidentity.com", "url": "https://backstage.pingidentity.com/downloads/browse/idm/featured"}], "sourceIdentifier": "responsible-disclosure@pingidentity.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1220"}], "source": "responsible-disclosure@pingidentity.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.3.0,7.3.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.2.0,7.2.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.1.*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "PingIDM", "source": "cna", "vendor": "Ping Identity"}, "product": "pingidm", "vendor": "pingidentity"}], "analysis": {"en": {"generated_at": "2026-04-07T23:12:20.535408+00:00", "value": {"mitigation_remediation": ["Upgrade PingIDM to one of the fixed versions released by the vendor", "Secure the /openicf endpoint by applying the new access and authentication configuration options provided in the migration documentation", "If immediate upgrade is not possible, configure a reverse proxy (e.g., PingGateway) to enforce IP and certificate\u2011based rules for the /openicf endpoint", "Reconfigure all Remote Connector Server instances to run in server mode to eliminate the client\u2011mode vulnerability", "Verify that the latest vendor updates have been applied and monitor for future advisories"], "summary": {"action": "Immediate Patch", "impact": "Identity Compromise"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Ping Identity\u2019s PingIDM product. Specific version details are not provided in the available information.", "description_and_impact": "PingIDM, formerly ForgeRock Identity Management, contains an access control weakness that allows an attacker to impersonate a Remote Connector Server (RCS) running in client mode. By spoofing the RCS endpoint, the attacker can intercept or modify an identity\u2019s security-relevant properties, such as passwords and account recovery information. This flaw leads to a loss of confidentiality and integrity for credential data and can result in full account compromise.", "risk_and_exploitability": "The flaw carries a CVSS score of 6.9, indicating moderate severity, and is not listed in the CISA KEV catalog. Exploitation requires that a Remote Connector Server be configured in client mode and that the attacker can reach the /openicf endpoint. The risk to an organization is elevated if such a client\u2011mode server is in use, since a spoofed RCS can alter passwords and recovery data without the administrator\u2019s knowledge."}}}}, "created": "2026-04-08T19:45:12.554409+00:00", "updated": "2026-04-09T08:22:56.676833+00:00", "vendors": ["pingidentity", "pingidentity$PRODUCT$pingidm"]}