Ping Identity Pingfederate
17 CVEs affecting Ping Identity Pingfederate. Latest disclosed: 2026-08-10. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40329 | Critical | 9.8 | 2021-09-27 | The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. |
CVE-2023-40545 | High | 8.8 | 2024-02-06 | Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. |
CVE-2023-37283 | High | 8.1 | 2023-10-25 | Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter |
CVE-2023-39219 | High | 7.5 | 2023-10-25 | PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests |
CVE-2023-40148 | Medium | 6.5 | 2024-04-10 | Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forge… |
CVE-2022-23722 | Medium | 6.5 | 2022-05-02 | When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authenticatio… |
CVE-2022-40724 | Medium | 6.4 | 2023-04-25 | The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests. |
CVE-2024-22377 | Medium | 5.3 | 2024-07-09 | The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. |
CVE-2021-42000 | Medium | 5.3 | 2022-02-10 | When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple paral… |
CVE-2024-21832 | Low | 3.5 | 2024-07-09 | A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. |
CVE-2023-34085 | Low | 2.6 | 2023-10-25 | When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request |
CVE-2024-22477 | Low | 1.8 | 2024-07-09 | A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only. |
CVE-2025-32736 | | 2026-08-10 | Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actio… | |
CVE-2025-26862 | | 2025-10-27 | Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may… | |
CVE-2024-25573 | | 2025-06-15 | Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing. | |
CVE-2025-22854 | | 2025-06-15 | Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions. | |
CVE-2025-21085 | | 2025-06-15 | PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization. |