Ping Identity vulnerabilities
53 vulnerabilities
Known vulnerabilities in Ping Identity products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 28 products.
Products
28- Pingfederate18 vulnerabilities
- Pingid Windows Login6 vulnerabilities
- Pingaccess3 vulnerabilities
- Pingam2 vulnerabilities
- Pingdirectory2 vulnerabilities
- Pingid Mobile Application2 vulnerabilities
- Pingid Radius PCV2 vulnerabilities
- Pingidm2 vulnerabilities
- Pingone MFA Integration Kit For Pingfederate2 vulnerabilities
- One Time Passcode Integration Kit For Pingfederate1 vulnerabilities
- Pingam Java Policy Agent1 vulnerabilities
- Pingcentral1 vulnerabilities
- Pingfederate (Includes Pingid Adapter)1 vulnerabilities
- Pingfederate (Includes Radius PCV)1 vulnerabilities
- Pingfederate Pingone MFA Integration Kit1 vulnerabilities
- Pinggateway1 vulnerabilities
- Pingid Adapter For Pingfederate1 vulnerabilities
- Pingid Desktop1 vulnerabilities
- Pingid Desktop For Macos1 vulnerabilities
- Pingid Desktop For Windows1 vulnerabilities
- Pingid Integration For Windows Login1 vulnerabilities
- Pingid Integration Kit (Includes Pingid Adapter)1 vulnerabilities
- Pingid Integration Kit (Includes Radius PCV)1 vulnerabilities
- Pingid Mac Login1 vulnerabilities
- Pingone MFA Integration Kit1 vulnerabilities
- RSA Securid Integration Kit1 vulnerabilities
- Self Service Account Manager1 vulnerabilities
- Unspecified1 vulnerabilities
CVE-2018-25084ping identityself-service account manager+1
EPSS score0.52%
A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.CVE-2021-40329ping identitypingfederate+1EPSS score1.15%
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.CVE-2021-41995ping identitypingid mac login+1EPSS score0.78%
A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.CVE-2021-41993ping identitypingid mobile application+2EPSS score0.24%
A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.CVE-2021-41992ping identitypingid windows login+1EPSS score0.50%
A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.CVE-2021-41994ping identitypingid mobile application+2EPSS score0.24%
A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.CVE-2021-42000ping identitypingfederate+1EPSS score0.53%
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.CVE-2021-42001ping identitypingid desktop+1EPSS score0.51%
PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.CVE-2021-31923ping identitypingaccess+1EPSS score0.71%
Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.CVE-2021-39270ping identityrsa securid integration kit+1EPSS score0.41%
In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.CVE-2025-21085ping identitypingfederateEPSS score0.34%
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.CVE-2025-26862ping identitypingfederateEPSS score0.28%
Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.CVE-2025-20628ping identitypingidmEPSS score0.24%
An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.CVE-2025-20059ping identitypingam java policy agentEPSS score0.95%
Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9.CVE-2025-27935ping identityone-time passcode integration kit for pingfederateEPSS score0.51%
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.CVE-2025-22854ping identitypingfederateEPSS score0.34%
Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.CVE-2025-32736ping identitypingfederateEPSS score0.21%
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.CVE-2022-40724ping identitypingfederate+1EPSS score0.18%
The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.CVE-2022-40725ping identitypingid desktop for macos+2EPSS score0.19%
PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.CVE-2022-40723ping identitypingfederate (includes radius pcv)+5EPSS score0.52%
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.