Product by Ping Identity

    Pingfederate

    20 known vulnerabilities in Pingfederate (Ping Identity), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Pingfederate (Ping Identity)
    CriticalCVE-2021-40329

    Ping Identity PingFederate: security vulnerability

    also in 1 other product

    		9.8
    CriticalCVE-2023-40545

    PingFederate OAuth client_secret_jwt Authentication Bypass

    also in 1 other product

    		8.8
    HighCVE-2026-20773

    Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

    		—
    CriticalCVE-2023-37283

    Authentication Bypass via HTML Form & Identifier First Adapter

    also in 1 other product

    		8.1
    HighCVE-2023-39219

    Admin Console Denial of Service via Java class enumeration

    also in 1 other product

    		7.5
    MediumCVE-2022-23722

    PingFederate Password Reset via Authentication API Mishandling

    also in 1 other product

    		6.5
    MediumCVE-2024-25573

    Stored Cross-Site Scripting in Administrative Console Context

    		—
    MediumCVE-2022-40723

    Ping Identity PingID Radius PCV: Authentication Bypass by Primary Weakness

    also in 2 other products

    		6.5
    MediumCVE-2023-40148

    PingFederate Server Side Request Forgery vulnerability

    		6.5
    MediumCVE-2025-22854

    Possible thread exhaustion from processing http responses in PingFederate Google Adapter

    		—
    MediumCVE-2025-32736

    PingFederate Administrative Console CSRF weaknesses

    		—
    HighCVE-2022-40722

    Ping Identity PingID Adapter for PingFederate: Use of RSA Algorithm without OAEP

    also in 2 other products

    		7.7
    MediumCVE-2024-22377

    PingFederate Runtime Node Path Traversal

    also in 1 other product

    		5.3
    MediumCVE-2021-42000

    Ping Identity PingFederate: Improper Authorization

    also in 1 other product

    		5.3
    HighCVE-2022-40724

    Ping Identity PingFederate: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		6.4
    MediumCVE-2023-34085

    User Attribute Disclosure via DynamoDB Data Stores

    also in 1 other product

    		2.6
    LowCVE-2025-21085

    PingFederate OAuth Grant attribute duplication may use excessive memory

    		—
    LowCVE-2024-21832

    PingFederate REST API Data Store Injection

    		3.5
    MediumCVE-2024-22477

    PingFederate OIDC Policy Management Editor Cross-Site Scripting

    also in 1 other product

    		1.8
    Not ratedCVE-2025-26862

    PingFederate unexpected browser flow initiation in redirectless mode

    		—

    All products by Ping Identity