Ping Identity

Latest CVEs · RSS

• CVE-2026-80327 2026-10-06 · CVSS 5.1
  An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024
• CVE-2026-21391 2026-09-14 · CVSS 9.5
  An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In
• CVE-2026-20773 2026-09-14 · CVSS 8.5
  A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative r
• CVE-2025-32736 2026-08-10 · CVSS 4.9
  Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized action
• CVE-2026-20746 2026-06-12 · CVSS 6.3
  Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login histor
• CVE-2025-20628 2026-04-07 · CVSS 6.9
  An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly conf
• CVE-2025-27935 2025-12-04 · CVSS 8.6
  The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state wit
• CVE-2025-26862 2025-10-27 · CVSS 0.0
  Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may
• CVE-2024-25573 2025-06-15 · CVSS 6.9
  Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.
• CVE-2025-22854 2025-06-15 · CVSS 6.9
  Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.
• CVE-2025-21085 2025-06-15 · CVSS 2.1
  PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.
• CVE-2025-20059 2025-02-20 · CVSS 9.2
  Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through
• CVE-2024-23983 2024-11-11 · CVSS 5.8
  Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
• CVE-2024-25566 2024-10-29 · CVSS 5.1
  An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redi
• CVE-2024-23600 2024-08-01 · CVSS 2.7
  Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing appro
• CVE-2024-21832 2024-07-09 · CVSS 3.5
  A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.
• CVE-2024-22377 2024-07-09 · CVSS 5.3
  The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
• CVE-2024-22477 2024-07-09 · CVSS 1.8
  A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
• CVE-2023-40356 2024-07-09 · CVSS 8.7
  PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could
• CVE-2023-40702 2024-07-09 · CVSS 7.7
  PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor
• CVE-2024-23316 2024-05-31 · CVSS 8.8
  HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header reques
• CVE-2023-40148 2024-04-10 · CVSS 6.5
  Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged
• CVE-2023-40545 2024-02-06 · CVSS 8.8
  Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
• CVE-2023-36496 2024-02-01 · CVSS 7.7
  Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.
• CVE-2023-34085 2023-10-25 · CVSS 2.6
  When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request