# Ping Identity PingFederate.

Every CVE that names Ping Identity PingFederate among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint](https://agentprime.io/advisories/CVE-2026-20773.md)
  `CVE-2026-20773` · CVE record: Ping Identity PingFederate · CVSS 8.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [PingFederate Administrative Console CSRF weaknesses](https://agentprime.io/advisories/CVE-2025-32736.md)
  `CVE-2025-32736` · CVE record: Ping Identity PingFederate · CVSS 4.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [PingFederate unexpected browser flow initiation in redirectless mode](https://agentprime.io/advisories/CVE-2025-26862.md)
  `CVE-2025-26862` · CVE record: Ping Identity PingFederate · CVSS 0.0 None · Not analysed yet · Published 27 Oct 2025 · Tags: Authentication bypass
- [Stored Cross-Site Scripting in Administrative Console Context](https://agentprime.io/advisories/CVE-2024-25573.md)
  `CVE-2024-25573` · CVE record: Ping Identity PingFederate · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2025 · Tags: Cross-site scripting (XSS)
- [Possible thread exhaustion from processing http responses in PingFederate Google Adapter](https://agentprime.io/advisories/CVE-2025-22854.md)
  `CVE-2025-22854` · CVE record: Ping Identity PingFederate · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2025 · Tags: CWE-394
- [PingFederate OAuth Grant attribute duplication may use excessive memory](https://agentprime.io/advisories/CVE-2025-21085.md)
  `CVE-2025-21085` · CVE record: Ping Identity PingFederate · CVSS 2.1 Low · Not analysed yet · Published 15 Jun 2025 · Tags: CWE-462
- [PingFederate REST API Data Store Injection](https://agentprime.io/advisories/CVE-2024-21832.md)
  `CVE-2024-21832` · CVE record: Ping Identity PingFederate · CVSS 3.5 Low · Not analysed yet · Published 9 Jul 2024 · Tags: Code injection
- [PingFederate Runtime Node Path Traversal](https://agentprime.io/advisories/CVE-2024-22377.md)
  `CVE-2024-22377` · CVE record: Ping Identity PingFederate · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Path traversal
- [PingFederate OIDC Policy Management Editor Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-22477.md)
  `CVE-2024-22477` · CVE record: Ping Identity PingFederate · CVSS 1.8 Low · Not analysed yet · Published 9 Jul 2024 · Tags: Cross-site scripting (XSS)
- [PingFederate Server Side Request Forgery vulnerability](https://agentprime.io/advisories/CVE-2023-40148.md)
  `CVE-2023-40148` · CVE record: Ping Identity PingFederate · CVSS 6.5 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: Server-side request forgery (SSRF)
- [PingFederate OAuth client_secret_jwt Authentication Bypass](https://agentprime.io/advisories/CVE-2023-40545.md)
  `CVE-2023-40545` · CVE record: Ping Identity PingFederate · CVSS 8.8 High · Not analysed yet · Published 6 Feb 2024 · Tags: Authentication bypass
- [User Attribute Disclosure via DynamoDB Data Stores](https://agentprime.io/advisories/CVE-2023-34085.md)
  `CVE-2023-34085` · CVE record: Ping Identity PingFederate · CVSS 2.6 Low · Not analysed yet · Published 25 Oct 2023 · Tags: Information disclosure
- [Admin Console Denial of Service via Java class enumeration](https://agentprime.io/advisories/CVE-2023-39219.md)
  `CVE-2023-39219` · CVE record: Ping Identity PingFederate · CVSS 7.5 High · Not analysed yet · Published 25 Oct 2023 · Tags: Denial of service
- [Authentication Bypass via HTML Form & Identifier First Adapter](https://agentprime.io/advisories/CVE-2023-37283.md)
  `CVE-2023-37283` · CVE record: Ping Identity PingFederate · CVSS 8.1 High · Not analysed yet · Published 25 Oct 2023 · Tags: Authentication bypass
- [Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.](https://agentprime.io/advisories/CVE-2022-40724.md)
  `CVE-2022-40724` · CVE record: Ping Identity PingFederate · CVSS 6.4 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: Cross-site request forgery (CSRF)
- [PingFederate Password Reset via Authentication API Mishandling](https://agentprime.io/advisories/CVE-2022-23722.md)
  `CVE-2022-23722` · CVE record: Ping Identity PingFederate · No CVSS score · Not analysed yet · Published 2 May 2022 · Tags: Authentication bypass
- [Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows](https://agentprime.io/advisories/CVE-2021-42000.md)
  `CVE-2021-42000` · CVE record: Ping Identity PingFederate · CVSS 5.3 Medium · Not analysed yet · Published 10 Feb 2022 · Tags: Broken access control
- [Ping Identity PingFederate: The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain…](https://agentprime.io/advisories/CVE-2021-40329.md)
  `CVE-2021-40329` · CVE record: Ping Identity PingFederate · No CVSS score · Not analysed yet · Published 27 Sept 2021

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=ping-identity-pingfederate>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/ping-identity-pingfederate/>. Everything for agents: <https://agentprime.io/llms.txt>.