EUVD-2026-77373
GHSA-xffc-pg4j-3qv4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible admin endpoint, low-privilege auth required; scope change because expression execution impacts all downstream federated systems beyond PingFederate itself.
Primary rating from Vendor (Ping Identity).
CVSS VectorVendor: Ping Identity
Lifecycle Timeline
3DescriptionCVE.org
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
AnalysisAI
Incorrect authorization in PingFederate's administrative expression evaluation endpoint allows authenticated low-privilege administrative users to invoke expression testing functionality reserved for higher-privileged roles. The CVSS 4.0 vector (8.5, PR:L) confirms exploitation requires an existing administrative account, but the substantial downstream impact (SC:H/SI:H/SA:H) reflects that PingFederate acts as an identity broker - compromising its expression evaluation capability cascades to every system relying on it for authentication and authorization decisions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session as a PingFederate administrative user holding one of the 'certain administrative roles' described - this is a low-privilege (PR:L) authenticated condition, not unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 (High) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch as described in Ping Identity Security Advisory SECADV054, available at https://support.pingidentity.com/s/article/SECADV054-Improper-Authorization-in-PingFederate-Administrative-Expression-Evaluation-Endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all PingFederate administrative user accounts, identify those with lower-privilege roles, and review expression evaluation endpoint access logs for the past 90 days to detect potential exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pingfederate
View allUnder a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Iden
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password managem
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XM
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Tim
Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote atta
The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. Rated medium severity (CVSS 5.3),
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. Rated medium severity (C
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today