EUVD-2025-210672
GHSA-hgvh-9fpj-948w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin-level session required (PR:H) and active browser interaction mandatory (UI:R); scope change (S:C) reflects that unauthorized admin actions alter federation trust affecting systems beyond the console.
Primary rating from Vendor (pingidentity).
CVSS VectorVendor: pingidentity
Lifecycle Timeline
2DescriptionCVE.org
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
AnalysisAI
Cross-site request forgery in PingFederate's Administrative Console allows remote actors to trick authenticated administrators into unknowingly executing unauthorized actions - such as altering federation trust relationships, adding rogue identity providers, or modifying SP connections - by luring them to load attacker-crafted links while an admin session is active. All PingFederate releases prior to version 13.1 are affected, and the June 2026 release of 13.1 contains the vendor-confirmed fix. Proof-of-concept exploit code is publicly available per the CVSS 4.0 E:P threat metric, and no CISA KEV listing exists at time of analysis.
Technical ContextAI
PingFederate is Ping Identity's enterprise identity federation server implementing SAML 2.0, OAuth 2.0, OpenID Connect, and WS-Federation for federated single sign-on across organizational boundaries. The vulnerability affects its web-based Administrative Console, where state-changing requests lack proper CSRF token validation, a root-cause class defined by CWE-352 (Cross-Site Request Forgery). CSRF flaws arise when a server authenticates requests solely via browser-managed credentials (session cookies) without verifying that the request was deliberately initiated by the user - allowing a third-party page to silently submit requests on the administrator's behalf. The CVSS 4.0 vector specifies AV:N, confirming the admin console is network-reachable, and PR:H, confirming exploitation requires a valid administrator-level session. The subsequent-system impact metrics SC:H and SI:H reflect the privileged position of PingFederate in an enterprise identity chain: unauthorized administrative actions can propagate high-integrity and high-confidentiality compromise to every service provider and identity store governed by the federation.
RemediationAI
The definitive fix is to upgrade PingFederate to version 13.1 or later, as documented in the June 2026 release notes at https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes.html#pingfederate-13-1-june-2026, with binaries available at https://www.pingidentity.com/en/resources/downloads/pingfederate.html. Where immediate upgrade is not operationally feasible, the most effective compensating control is to restrict network access to the Administrative Console to a dedicated management VLAN or VPN-only path - this prevents administrators from reaching the console from the same browser sessions used for general internet access, directly breaking the CSRF delivery model, though it introduces access-workflow overhead for administrators. Enforcing aggressively short administrative session timeouts minimizes the window during which an active session can be silently abused; the trade-off is increased re-authentication friction for administrators. Supplementary behavioral guidance to administrators - advising against browsing external sites or reading email while logged into the admin console - is a zero-cost control with no system side effects, though it is not reliably enforceable. None of these workarounds eliminate the underlying CWE-352 defect; patching to version 13.1 remains the only definitive remediation.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today