EUVD-2026-77425
GHSA-cvq5-qf5h-v345
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network unauthenticated token forgery gated by a specific configuration (AC:H); scope changes to relying parties (S:C) with high identity confidentiality/integrity impact and low availability effect.
Primary rating from Vendor (Ping Identity).
CVSS VectorVendor: Ping Identity
Lifecycle Timeline
3DescriptionCVE.org
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
AnalysisAI
Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a PingAM deployment acting as an OpenID Connect / ID Token issuer in a vulnerable configuration ('in certain configurations,' reflected by CVSS AT:P attack requirements), where the token-issuance path lets a crafted request set or override arbitrary or protected ID Token claims. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue but the raw 9.5 CVSS 4.0 score slightly overstates trivial exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Ping Identity fix per the vendor advisory (PingAM Security Advisory 202603, https://support.pingidentity.com/s/article/PingAM-Security-Advisory-202603); a patch is available from the vendor, though exact fixed build numbers per branch are not enumerated in the provided data and should be taken directly from that advisory for your specific 7.0.x-8.1.0 branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Ping Identity PingAM deployments and document current versions; review authentication and token-related audit logs for suspicious claim manipulation or validation failures. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today