PI
Product
PingFederate
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 7Low 2
Watch
Add PingFederate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-40545 | 9.8 | Feb 6 | PingFederate OAuth client_secret_jwt Authentication Bypass Affected: 11.3.0 through 11.3.2 |
| CVE-2023-37283 | 9.8 | Oct 25 | Authentication Bypass via HTML Form & Identifier First Adapter Affected: 11.3 through 11.3.0; 11.2.0 through 11.2.6; 11.1.0 through 11.1.7; 10.3.0 through 10.3.12 |
| CVE-2026-20773 | 8.5 | Sep 14 | Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint Affected: 13.0.0 through 13.0.1; 12.3.0 through 12.3.5; 12.2.0 through 12.2.7; 12.1.0 through 12.1.10; 12.0.0 through 12.0.10; 11.3.0 through 11.3.14 |
| CVE-2023-39219 | 7.5 | Oct 25 | Admin Console Denial of Service via Java class enumeration Affected: 11.3 through 11.3.0; 11.2.0 through 11.2.6; 11.1.0 through 11.1.7; 10.3.0 through 10.3.12 |
| CVE-2024-25573 | 6.9 | Jun 15 | Stored Cross-Site Scripting in Administrative Console Context Affected: 12.1.0 through 12.1.4; 12.0.0 through 12.0.6; 11.3.0 through 11.3.9; 11.2.0 through 11.2.10 |
| CVE-2025-22854 | 6.9 | Jun 15 | Possible thread exhaustion from processing http responses in PingFederate Google Adapter Affected: 1.0.1 before 1.5.2 |
| CVE-2023-40148 | 6.5 | Apr 10 | PingFederate Server Side Request Forgery vulnerability Affected: 11.3.0 through 11.3.2; 11.2.0 through 11.2.7; 11.1.0 through 11.1.8; 11.0.0 through 11.0.8 |
| CVE-2024-22377 | 5.3 | Jul 9 | PingFederate Runtime Node Path Traversal Affected: 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0; 10.3.0 through 10.3.13 |
| CVE-2025-32736 | 4.9 | Aug 10 | PingFederate Administrative Console CSRF weaknesses Affected: 10.0 before 13.1 |
| CVE-2024-22477 | 4.3 | Jul 9 | PingFederate OIDC Policy Management Editor Cross-Site Scripting Affected: 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0; 10.3.0 through 10.3.13 |
| CVE-2023-34085 | 4.3 | Oct 25 | User Attribute Disclosure via DynamoDB Data Stores Affected: 11.3 through 11.3.0 |
| CVE-2024-21832 | 3.5 | Jul 9 | PingFederate REST API Data Store Injection Affected: 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0 |
| CVE-2025-21085 | 2.1 | Jun 15 | PingFederate OAuth Grant attribute duplication may use excessive memory Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.9; 12.0 before 12.0.9; 11.3.0 before 11.3.13 |
| CVE-2025-26862 | 0.0 | Oct 27 | PingFederate unexpected browser flow initiation in redirectless mode Affected: 11.3.0 before 11.3.14; 12.0.0 before 12.0.10; 12.1.0 before 12.1.9; 12.2.0 before 12.2.6; 12.3.0 before 12.3.3 |
Showing 14