Pingam
Monthly
Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.
Authentication bypass via ID Token claim spoofing in Ping Identity PingAM allows a remote attacker to inject or override protected ID Token claims through a well-crafted request. In vulnerable configurations this lets an attacker impersonate other identities or escalate privileges by forging trusted claims that downstream relying parties consume. Ping Identity has released a patch; no public exploit is identified at time of analysis, and CISA SSVC records exploitation status as none.