When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pingfederate | Pingidentity | 9.3.0 (including) | 9.3.3 (excluding) |
| Pingfederate | Pingidentity | 10.0.0 (including) | 10.0.12 (excluding) |
| Pingfederate | Pingidentity | 10.1.0 (including) | 10.1.9 (excluding) |
| Pingfederate | Pingidentity | 10.2.0 (including) | 10.2.7 (excluding) |
| Pingfederate | Pingidentity | 10.3.0 (including) | 10.3.4 (excluding) |
| Pingfederate | Pingidentity | 9.3.3-p15 (including) | 9.3.3-p15 (including) |
| Pingfederate | Pingidentity | 11.0.0 (including) | 11.0.0 (including) |