What’s Vulnerable › Vulnerabilities

CVE-2023-40545: PingFederate OAuth client_secret_jwt Authentication Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-06 · updated 2026-06-17
• Weakness: CWE-306

Description

Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.

Affected products

• Ping Identity PingFederate: 11.3.0

References

• https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236
• https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass
• https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html
• https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236
• https://support.pingidentity.com/s/article/SECADV040-PingFederate-OAuth-Client-Authentication-Bypass
• https://www.pingidentity.com/en/resources/downloads/pingfederate/previous-releases.html

Get alerted when CVE-2023-40545 or the next vulnerability affects your stack