CVE-2014-4631: RSA Adaptive Authentication (On-Premise) 6.0.2.1 through 7.1 P3, when using device binding in a Challenge S...

Security readout for executives and security teams

A configuration using RSA Adaptive Authentication On-Premise could bind a device permanently even after failed authentication. That could let a remote attacker later appear trusted and bypass authentication controls. The issue is limited to documented device-binding Challenge SOAP use or RSA Integration Adapters with Authentify out-of-band phone functionality. Exposure is most likely in legacy on-prem RSA Adaptive Authentication deployments using Challenge SOAP device binding or Authentify out-of-band phone adapters. Internet reachability is not stated, but remote attack is claimed in the CVE description. Treat this as high priority for any organization still running the affected RSA on-prem product because it concerns authentication bypass. Urgency depends on whether the specific device-binding features are enabled and whether vendor remediation has already been applied. Mitigation focus: Check RSA advisory ESA-2014-160 and vendor support guidance for fixed versions or workarounds.; Inventory RSA Adaptive Authentication On-Premise versions and confirm whether affected device-binding flows are enabled.; Disable or restrict affected device-binding integrations if vendor-approved remediation is unavailable..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.