{"cve":"CVE-2025-20628","nvd":{"published":"2026-04-07T23:16:27.040","modified":"2026-07-24T23:10:00.563","status":"Awaiting Analysis","description":"An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/S:P/AU:Y/R:U/V:C/RE:M/U:Red","score":6.9},"cvss_v3":null,"cwes":["CWE-1220"],"references":["https://backstage.forgerock.com/knowledge/advisories/article/a14305629?rev=_newest","https://backstage.pingidentity.com/downloads/browse/idm/featured"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2025-20628","score":0.00237,"percentile":0.14737,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}