Auth bypass in Ping Identity One-Time Passcode Integration Kit For Pingfederate
CVE-2025-27935
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Vulnerability class: Broken Authentication
EPSS: 0.005 (38.1th percentile) — read the EPSS interpretation.
Affected products
- Ping Identity One-time Passcode Integration Kit For Pingfederate — versions 1.0, 1.1.1