PingFederate CVE-2025-26862

Requires the PingFederate HTML Form Adapter to be running in the non-default 'redirectless' mode - this is NOT a default configuration, so default deployments are not exposed. Under that mode the adapter unexpectedly renders the authentication form, permitting repeated authentication attempts. Limiting factors: the non-default configuration requirement, high attack complexity (AC:H), required user/client interaction (UI:P), and PR:L (some privilege/valid context to reach the flow). Realistic impact further depends on weak passwords and the absence of compensating account-lockout or rate-limiting controls, since the flaw only enables attempts rather than directly compromising data.

This is a low-urgency weakness, not a direct-impact vulnerability. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:P with VC:N/VI:N/VA:N) encodes that the flaw itself produces NO direct confidentiality, integrity, or availability impact - it merely removes an expected guard so that repeated authentication attempts become possible (CWE-307). Any real impact (credential/account compromise) is downstream and probabilistic, depending on password strength and absence of other lockout controls. Signals align toward low real-world priority: EPSS is 0.28% (18th percentile), there is NO CISA KEV listing and NO public exploit identified at time of analysis. Crucially, exploitation is gated on a NON-DEFAULT configuration - 'redirectless mode' in the HTML Form Adapter - which sharply narrows the exposed population. AC:H and UI:P (user/client interaction) further reduce automatability. The 'Information Disclosure' tag conflicts with both the CWE (improper restriction of excessive authentication attempts) and the all-N impact metrics; this is an authentication-hardening/brute-force issue, not disclosure. No CVSS base SCORE was provided (only a vector), so severity magnitude is unconfirmed; the vector's all-N impacts imply a very low base score.

An attacker identifies a PingFederate deployment that has the HTML Form Adapter operating in the non-default redirectless mode. Because the adapter unexpectedly renders the authentication form in this mode, the attacker can submit repeated login attempts against a target username without the normally-expected restriction, enabling an online brute-force or password-spray attack toward account takeover. No public exploit code is identified at time of analysis, and the high complexity plus required interaction limit easy automation.