High severity · published Dec 4, 2025
CVE-2025-27935
Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit
8.6
CVSS
0.5%
EPSS
No
On KEV
Description
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
One-Time Passcode Integration Kit for PingFederate · Ping Identity
1.0 through 1.1 · source: vendor
Affected product
OP
One-Time Passcode Integration Kit for PingFederate
Ping Identity
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27935
support.pingidentity.com
https://support.pingidentity.com/s/article/SECADV051-PingFederate-OTP-Integration-Kit-authentication-bypass
www.pingidentity.com
https://www.pingidentity.com/en/resources/downloads/pingfederate.html