https://vulnogram.org/ Most recent CVEs assigned by ping_identity (ping_identity). https://vulnogram.org/seaview/icons/ping_identity.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-80327 https://vulnogram.org/CVE-2026-80327 An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2… Medium Network Exploitable Tue, 06 Oct 2026 09:56:05 GMT https://vulnogram.org/CVE-2026-21391 https://vulnogram.org/CVE-2026-21391 An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via… Critical Network Exploitable Mon, 14 Sep 2026 11:18:33 GMT https://vulnogram.org/CVE-2026-20773 https://vulnogram.org/CVE-2026-20773 A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions. High Mon, 14 Sep 2026 10:43:20 GMT https://vulnogram.org/CVE-2025-32736 https://vulnogram.org/CVE-2025-32736 Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions. Medium Mon, 10 Aug 2026 21:54:21 GMT https://vulnogram.org/CVE-2026-20746 https://vulnogram.org/CVE-2026-20746 Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values. Medium Fri, 12 Jun 2026 02:16:59 GMT https://vulnogram.org/CVE-2025-20628 https://vulnogram.org/CVE-2025-20628 An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means a… Medium Network Exploitable Tue, 07 Apr 2026 22:33:05 GMT https://vulnogram.org/CVE-2025-27935 https://vulnogram.org/CVE-2025-27935 The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication. High Thu, 04 Dec 2025 20:38:31 GMT https://vulnogram.org/CVE-2025-26862 https://vulnogram.org/CVE-2025-26862 Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks. Mon, 27 Oct 2025 14:39:41 GMT https://vulnogram.org/CVE-2024-25573 https://vulnogram.org/CVE-2024-25573 Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing. Medium Sun, 15 Jun 2025 15:25:38 GMT https://vulnogram.org/CVE-2025-22854 https://vulnogram.org/CVE-2025-22854 Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions. Medium Sun, 15 Jun 2025 15:00:06 GMT https://vulnogram.org/CVE-2025-21085 https://vulnogram.org/CVE-2025-21085 PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization. Low Sun, 15 Jun 2025 14:25:39 GMT https://vulnogram.org/CVE-2025-20059 https://vulnogram.org/CVE-2025-20059 Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9. Critical Network Exploitable Thu, 20 Feb 2025 14:11:28 GMT https://vulnogram.org/CVE-2024-23983 https://vulnogram.org/CVE-2024-23983 Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. Medium Network Exploitable Mon, 11 Nov 2024 22:56:58 GMT https://vulnogram.org/CVE-2024-25566 https://vulnogram.org/CVE-2024-25566 An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks Medium Network Exploitable Tue, 29 Oct 2024 15:34:53 GMT https://vulnogram.org/CVE-2024-23600 https://vulnogram.org/CVE-2024-23600 Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to information disclosure. Low Thu, 01 Aug 2024 16:55:22 GMT https://vulnogram.org/CVE-2024-21832 https://vulnogram.org/CVE-2024-21832 A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. Low Tue, 09 Jul 2024 23:04:55 GMT https://vulnogram.org/CVE-2024-22377 https://vulnogram.org/CVE-2024-22377 The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. Medium Network Exploitable Tue, 09 Jul 2024 23:03:27 GMT https://vulnogram.org/CVE-2024-22477 https://vulnogram.org/CVE-2024-22477 A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only. Low Tue, 09 Jul 2024 23:01:28 GMT https://vulnogram.org/CVE-2023-40356 https://vulnogram.org/CVE-2023-40356 PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring seco… High Tue, 09 Jul 2024 15:38:56 GMT https://vulnogram.org/CVE-2023-40702 https://vulnogram.org/CVE-2023-40702 PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able… High Tue, 09 Jul 2024 15:38:47 GMT https://vulnogram.org/CVE-2024-23316 https://vulnogram.org/CVE-2024-23316 HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests. High Network Exploitable Fri, 31 May 2024 19:08:35 GMT https://vulnogram.org/CVE-2023-40148 https://vulnogram.org/CVE-2023-40148 Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests. Medium Network Exploitable Wed, 10 Apr 2024 00:03:31 GMT https://vulnogram.org/CVE-2023-40545 https://vulnogram.org/CVE-2023-40545 Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. High Tue, 06 Feb 2024 17:27:42 GMT https://vulnogram.org/CVE-2023-36496 https://vulnogram.org/CVE-2023-36496 Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server. High Thu, 01 Feb 2024 23:00:03 GMT https://vulnogram.org/CVE-2023-34085 https://vulnogram.org/CVE-2023-34085 When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request Low Wed, 25 Oct 2023 02:03:56 GMT https://vulnogram.org/CVE-2023-39219 https://vulnogram.org/CVE-2023-39219 PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests High Network Exploitable Wed, 25 Oct 2023 01:44:44 GMT https://vulnogram.org/CVE-2023-37283 https://vulnogram.org/CVE-2023-37283 Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter High Network Exploitable Wed, 25 Oct 2023 01:24:47 GMT https://vulnogram.org/CVE-2023-39930 https://vulnogram.org/CVE-2023-39930 A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request. High Network Exploitable Tue, 24 Oct 2023 20:54:08 GMT https://vulnogram.org/CVE-2023-39231 https://vulnogram.org/CVE-2023-39231 PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA devi… High Tue, 24 Oct 2023 19:56:06 GMT https://vulnogram.org/CVE-2022-40725 https://vulnogram.org/CVE-2022-40725 PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated. High Tue, 25 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-40724 https://vulnogram.org/CVE-2022-40724 The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests. Medium Network Exploitable Tue, 25 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-40723 https://vulnogram.org/CVE-2022-40723 The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. Medium Tue, 25 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-40722 https://vulnogram.org/CVE-2022-40722 A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA. High Tue, 25 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-23721 https://vulnogram.org/CVE-2022-23721 PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times. Low Tue, 25 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-23726 https://vulnogram.org/CVE-2022-23726 PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information. Medium Fri, 30 Sep 2022 14:35:09 GMT https://vulnogram.org/CVE-2022-23725 https://vulnogram.org/CVE-2022-23725 PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. High Thu, 30 Jun 2022 19:25:46 GMT https://vulnogram.org/CVE-2022-23720 https://vulnogram.org/CVE-2022-23720 PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those… High Thu, 30 Jun 2022 19:25:41 GMT https://vulnogram.org/CVE-2022-23719 https://vulnogram.org/CVE-2022-23719 PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java s… High Thu, 30 Jun 2022 19:25:35 GMT https://vulnogram.org/CVE-2022-23718 https://vulnogram.org/CVE-2022-23718 PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver maliciou… High Thu, 30 Jun 2022 19:25:30 GMT https://vulnogram.org/CVE-2022-23717 https://vulnogram.org/CVE-2022-23717 PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication. Medium Thu, 30 Jun 2022 19:25:27 GMT https://vulnogram.org/CVE-2021-41995 https://vulnogram.org/CVE-2021-41995 A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. High Thu, 30 Jun 2022 19:25:23 GMT https://vulnogram.org/CVE-2022-23724 https://vulnogram.org/CVE-2022-23724 Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised… Medium Wed, 04 May 2022 16:30:11 GMT https://vulnogram.org/CVE-2022-23723 https://vulnogram.org/CVE-2022-23723 An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. High Mon, 02 May 2022 22:05:15 GMT https://vulnogram.org/CVE-2022-23722 https://vulnogram.org/CVE-2022-23722 When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password. Mon, 02 May 2022 22:05:13 GMT https://vulnogram.org/CVE-2021-42001 https://vulnogram.org/CVE-2021-42001 PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP. High Sat, 30 Apr 2022 21:15:24 GMT https://vulnogram.org/CVE-2021-41994 https://vulnogram.org/CVE-2021-41994 A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login. Medium Sat, 30 Apr 2022 21:15:22 GMT https://vulnogram.org/CVE-2021-41993 https://vulnogram.org/CVE-2021-41993 A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login. Medium Sat, 30 Apr 2022 21:15:21 GMT https://vulnogram.org/CVE-2021-41992 https://vulnogram.org/CVE-2021-41992 A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. High Sat, 30 Apr 2022 21:15:19 GMT https://vulnogram.org/CVE-2021-42000 https://vulnogram.org/CVE-2021-42000 When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password. Medium Network Exploitable Thu, 10 Feb 2022 22:30:11 GMT https://vulnogram.org/CVE-2021-41770 https://vulnogram.org/CVE-2021-41770 Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Thu, 07 Oct 2021 06:24:36 GMT