Ping Identity vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-21391 An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden.Critical 9.5 · Sep 14, 2026
• CVE-2026-20773 A role-based access control issue was identified in the administrative expression evaluation functionality.High 8.5 · Sep 14, 2026
• CVE-2025-27935 The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly.High 8.6 · Dec 4, 2025
• CVE-2025-20059 Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through Critical 9.2 · Feb 20, 2025
• CVE-2023-40702 PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factorHigh 7.7 · Jul 9, 2024
• CVE-2023-40356 PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration.High 8.7 · Jul 9, 2024
• CVE-2024-23316 HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requesHigh 8.8 · May 31, 2024
• CVE-2023-40545 Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.High 8.8 · Feb 6, 2024
• CVE-2023-36496 Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.High 7.7 · Feb 1, 2024
• CVE-2023-39930 A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciouHigh 7.5 · Oct 25, 2023
• CVE-2023-39231 PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered devicHigh 7.3 · Oct 25, 2023
• CVE-2023-39219 PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests High 7.5 · Oct 25, 2023
• CVE-2023-37283 Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter High 8.1 · Oct 25, 2023
• CVE-2022-40725 PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before theHigh 7.3 · Apr 25, 2023
• CVE-2022-40722 A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pHigh 7.7 · Apr 25, 2023
• CVE-2022-23725 PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.High 7.7 · Jun 30, 2022
• CVE-2022-23720 PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file.High 7.5 · Jun 30, 2022
• CVE-2022-23719 PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests.High 7.2 · Jun 30, 2022
• CVE-2022-23718 PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution.High 7.6 · Jun 30, 2022
• CVE-2021-41995 A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.High 7.7 · Jun 30, 2022
• CVE-2022-23723 An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.High 7.7 · May 2, 2022
• CVE-2021-42001 PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure.High 8 · Apr 30, 2022
• CVE-2021-41992 A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.High 7.7 · Apr 30, 2022
• CVE-2021-40329 The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.Critical 9.8 · Sep 27, 2021
• CVE-2021-39270 In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.High 7.5 · Aug 18, 2021