Pingfederate
Monthly
Incorrect authorization in PingFederate's administrative expression evaluation endpoint allows authenticated low-privilege administrative users to invoke expression testing functionality reserved for higher-privileged roles. The CVSS 4.0 vector (8.5, PR:L) confirms exploitation requires an existing administrative account, but the substantial downstream impact (SC:H/SI:H/SA:H) reflects that PingFederate acts as an identity broker - compromising its expression evaluation capability cascades to every system relying on it for authentication and authorization decisions. No public exploit has been identified at time of analysis, and there is no CISA KEV listing.
Unexpected authentication form rendering in PingFederate's HTML Form Adapter can permit repeated authentication attempts against a user context, making brute-force or password-guessing attacks more practical. Exposure is limited to deployments that have explicitly enabled the adapter's non-default redirectless mode, so default installations are not affected; successful abuse further depends on weak passwords and the absence of account lockout or rate-limiting controls. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score is low (0.28%, ~18th percentile), consistent with a low-urgency weakness rather than a direct-impact vulnerability.
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. Rated medium severity (CVSS 4.3), this vulnerability is low attack complexity. No vendor patch available.
The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Incorrect authorization in PingFederate's administrative expression evaluation endpoint allows authenticated low-privilege administrative users to invoke expression testing functionality reserved for higher-privileged roles. The CVSS 4.0 vector (8.5, PR:L) confirms exploitation requires an existing administrative account, but the substantial downstream impact (SC:H/SI:H/SA:H) reflects that PingFederate acts as an identity broker - compromising its expression evaluation capability cascades to every system relying on it for authentication and authorization decisions. No public exploit has been identified at time of analysis, and there is no CISA KEV listing.
Unexpected authentication form rendering in PingFederate's HTML Form Adapter can permit repeated authentication attempts against a user context, making brute-force or password-guessing attacks more practical. Exposure is limited to deployments that have explicitly enabled the adapter's non-default redirectless mode, so default installations are not affected; successful abuse further depends on weak passwords and the absence of account lockout or rate-limiting controls. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score is low (0.28%, ~18th percentile), consistent with a low-urgency weakness rather than a direct-impact vulnerability.
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. Rated medium severity (CVSS 4.3), this vulnerability is low attack complexity. No vendor patch available.
The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.