VulnSocial

CVE-2025-20628Disclosure

LOWCVSS 6.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1220

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-08: 2Technical Details · 2026-04-08: 204-08
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2025-20628 An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure … https://www.cve.org/CVERecord?id=CVE-2025-20628

    Post summary

    The statement announces an access‑control weakness in PingIDM, noting that administrators cannot properly configure permissions due to granularity limits; it provides basic technical details but no PoC, exploit, patch, or evidence of active exploitation.

    00000191
    57.0K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2025-20628 Insufficient Access Control in PingIDM Remote Connector Servers Client Mode https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-20628

    Post summary

    The text announces CVE‑2025‑20628, describing an insufficient access control issue in PingIDM Remote Connector Servers (client mode); no PoC, exploit code, active exploitation, or patch information is provided.

    00000111
    4.0K followersView on X

Explore more

Back to dashboard