What’s Vulnerable › Products

Ping Identity PingFederate vulnerabilities

22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Ping Identity PingFederate version is affected

Latest Ping Identity PingFederate vulnerabilities

• CVE-2026-20773 — Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint (CVSS 8.5)
• CVE-2025-32736 — PingFederate Administrative Console CSRF weaknesses (CVSS 4.9)
• CVE-2025-26862 — PingFederate unexpected browser flow initiation in redirectless mode (CVSS 0.0)
• CVE-2024-25573 — Stored Cross-Site Scripting in Administrative Console Context (CVSS 6.9)
• CVE-2025-22854 — Possible thread exhaustion from processing http responses in PingFederate Google Adapter (CVSS 6.9)
• CVE-2025-21085 — PingFederate OAuth Grant attribute duplication may use excessive memory (CVSS 2.1)
• CVE-2024-22477 — PingFederate OIDC Policy Management Editor Cross-Site Scripting (CVSS 4.3)
• CVE-2024-22377 — PingFederate Runtime Node Path Traversal (CVSS 5.3)
• CVE-2024-21832 — PingFederate REST API Data Store Injection (CVSS 3.5)
• CVE-2023-40148 — PingFederate Server Side Request Forgery vulnerability (CVSS 6.5)
• CVE-2023-40545 — PingFederate OAuth client_secret_jwt Authentication Bypass (CVSS 9.8)
• CVE-2023-39219 — Admin Console Denial of Service via Java class enumeration (CVSS 7.5)
• CVE-2023-37283 — Authentication Bypass via HTML Form & Identifier First Adapter (CVSS 9.8)
• CVE-2023-34085 — User Attribute Disclosure via DynamoDB Data Stores (CVSS 4.3)
• CVE-2022-40724 — Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. (CVSS 8.8)
• CVE-2022-40723 — Configuration-based MFA Bypass in PingID RADIUS PCV. (CVSS 6.5)
• CVE-2022-40722 — Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. (CVSS 5.8)
• CVE-2022-23722 — PingFederate Password Reset via Authentication API Mishandling (CVSS 6.5)
• CVE-2021-42000 — Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows (CVSS 6.5)
• CVE-2021-41770 — (CVSS 7.5)
• CVE-2021-40329 — (CVSS 9.8)
• CVE-2014-8489 — (CVSS 6.4)