PT-2026-31046 · Forgerock · Pingidm+1

Published 2026-04-07 · Updated 2026-04-08 · CVE-2025-20628

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/S:P/AU:Y/R:U/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions PingIDM (formerly ForgeRock Identity Management) (affected versions not specified)

Description An insufficient granularity of access control issue exists in PingIDM where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This allows attackers to spoof a client-mode RCS to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This is exploitable only when an RCS is configured to run in client mode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1220

Related Identifiers

CVE-2025-20628

Affected Products

Forgerock Identity Management

Pingidm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-20628 · Security Note
• https://backstage.forgerock.com/knowledge/advisories/article/a14305629?rev=_newest · Note
• https://backstage.pingidentity.com/downloads/browse/idm/featured · Note
• https://twitter.com/CVEnew/status/2041711845615268067 · Twitter Post