Pingidentity vulnerabilities
We track 6 vulnerabilities in Pingidentity products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 9, 2024.
Latest Pingidentity vulnerabilities
- 7.7 High severity
PingOne MFA Integration Kit for PingFederate: Authentication Bypass by Spoofing
PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit
- 8.8 High severity
PingAccess: Inconsistent Interpretation of HTTP Requests
HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests.
- 9.8 Critical severity
PingFederate: Missing Authentication for Critical Functionality
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
- 8.2 High severity
PingID Windows Login: Improper Privilege Management
PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically
- 8.1 High severity
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote…
PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code tha
- 7.7 High severity
PingFederate PingOne MFA Integration Kit: Improper Authentication
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.