CVE-2025-20628
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PingIDM (formerly ForgeRock Identity Management) has insufficient granularity of access control for Remote Connector Servers (RCS) in client mode. Attackers can spoof a client-mode RCS to intercept or modify identity security properties such as passwords and account recovery information.
Risk Assessment
An attacker can take over user accounts by changing passwords and recovery data, leading to identity security compromise.
Recommendation
Configure access rules for RCS in client mode according to PingIDM documentation, or disable client mode if not required.
Original NVD description (English source)
An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.