Advisories · Technology

Ping Identity PingFederate.

Every CVE that names Ping Identity PingFederate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-20773 CVE record

CVSS 8.5 High

Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
- Ping Identity PingFederate
- Broken access control
Not analysed yet 14 Sept 2026
CVE-2025-32736 CVE record

CVSS 4.9 Medium

PingFederate Administrative Console CSRF weaknesses
- Ping Identity PingFederate
- Cross-site request forgery (CSRF)
Not analysed yet 10 Aug 2026
CVE-2025-26862 CVE record

CVSS 0.0 None

PingFederate unexpected browser flow initiation in redirectless mode
- Ping Identity PingFederate
- Authentication bypass
Not analysed yet 27 Oct 2025
CVE-2024-25573 CVE record

CVSS 6.9 Medium

Stored Cross-Site Scripting in Administrative Console Context
- Ping Identity PingFederate
- Cross-site scripting (XSS)
Not analysed yet 15 Jun 2025
CVE-2025-22854 CVE record

CVSS 6.9 Medium

Possible thread exhaustion from processing http responses in PingFederate Google Adapter
- Ping Identity PingFederate
- CWE-394
Not analysed yet 15 Jun 2025
CVE-2025-21085 CVE record

CVSS 2.1 Low

PingFederate OAuth Grant attribute duplication may use excessive memory
- Ping Identity PingFederate
- CWE-462
Not analysed yet 15 Jun 2025
CVE-2024-21832 CVE record

CVSS 3.5 Low

PingFederate REST API Data Store Injection
- Ping Identity PingFederate
- Code injection
Not analysed yet 9 Jul 2024
CVE-2024-22377 CVE record

CVSS 5.3 Medium

PingFederate Runtime Node Path Traversal
- Ping Identity PingFederate
- Path traversal
Not analysed yet 9 Jul 2024
CVE-2024-22477 CVE record

CVSS 1.8 Low

PingFederate OIDC Policy Management Editor Cross-Site Scripting
- Ping Identity PingFederate
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2024
CVE-2023-40148 CVE record

CVSS 6.5 Medium

PingFederate Server Side Request Forgery vulnerability
- Ping Identity PingFederate
- Server-side request forgery (SSRF)
Not analysed yet 10 Apr 2024
CVE-2023-40545 CVE record

CVSS 8.8 High

PingFederate OAuth client_secret_jwt Authentication Bypass
- Ping Identity PingFederate
- Authentication bypass
Not analysed yet 6 Feb 2024
CVE-2023-34085 CVE record

CVSS 2.6 Low

User Attribute Disclosure via DynamoDB Data Stores
- Ping Identity PingFederate
- Information disclosure
Not analysed yet 25 Oct 2023
CVE-2023-39219 CVE record

CVSS 7.5 High

Admin Console Denial of Service via Java class enumeration
- Ping Identity PingFederate
- Denial of service
Not analysed yet 25 Oct 2023
CVE-2023-37283 CVE record

CVSS 8.1 High

Authentication Bypass via HTML Form & Identifier First Adapter
- Ping Identity PingFederate
- Authentication bypass
Not analysed yet 25 Oct 2023
CVE-2022-40724 CVE record

CVSS 6.4 Medium

Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.
- Ping Identity PingFederate
- Cross-site request forgery (CSRF)
Not analysed yet 25 Apr 2023
CVE-2022-23722 CVE record

PingFederate Password Reset via Authentication API Mishandling
- Ping Identity PingFederate
- Authentication bypass
Not analysed yet 2 May 2022
CVE-2021-42000 CVE record

CVSS 5.3 Medium

Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
- Ping Identity PingFederate
- Broken access control
Not analysed yet 10 Feb 2022
CVE-2021-40329 CVE record

Ping Identity PingFederate: The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain…
- Ping Identity PingFederate
Not analysed yet 27 Sept 2021