responsible-disclosure@pingidentity.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS responsible-disclosure@pingidentity.com
03
assessed vulnerabilities (48)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-80327US | — | — | ||
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0… | ||||
| CVE-2026-21391US | — | — | ||
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurati… | ||||
| CVE-2026-20773US | —OT elevated | — | ||
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expre… | ||||
| CVE-2025-32736US | — | — | ||
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-craf… | ||||
| CVE-2026-20746US | — | — | ||
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and cop… | ||||
| CVE-2025-20628US | — | — | ||
An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules f… | ||||
| CVE-2025-27935US | —OT elevated | — | ||
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the O… | ||||
| CVE-2025-26862US | — | — | ||
Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force l… | ||||
| CVE-2024-25573US | — | — | ||
Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing. | ||||
| CVE-2025-22854US | — | — | ||
Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions. | ||||
| CVE-2025-21085US | — | — | ||
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization. | ||||
| CVE-2025-20059US | — | — | ||
Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023… | ||||
| CVE-2024-23983US | — | — | ||
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. | ||||
| CVE-2024-25566US | medium6.1 | — | ||
An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to ma… | ||||
| CVE-2024-23600US | — | — | ||
Improper Input Validation of query search results for private field data in PingIDM (Query Filter module) allows for a potentially efficient brute forcing approach leading to infor… | ||||
| CVE-2024-22477US | medium4.3 | — | ||
A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only. | ||||
| CVE-2024-22377US | medium5.3 | — | ||
The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. | ||||
| CVE-2024-21832US | — | — | ||
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. | ||||
| CVE-2023-40702US | — | — | ||
PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from… | ||||
| CVE-2023-40356US | — | — | ||
PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA… | ||||