PingFederate vulnerabilities

4 known vulnerabilities in PingFederate from Ping Identity. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  PingFederate: Incorrect Authorization

  CVE-2026-20773Sep 14, 2026Ping Identity

  A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.

• 9.8 Critical severity

  PingFederate: Missing Authentication for Critical Functionality

  CVE-2023-40545Feb 6, 2024Ping Identity

  Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.

• 7.5 High severity

  PingFederate: Uncontrolled Resource Consumption

  CVE-2023-39219Oct 25, 2023Ping Identity

  PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests

• 8.8 High severity

  PingFederate: Cross-Site Request Forgery

  CVE-2022-40724Apr 25, 2023Ping Identity

  The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.