The CVE-2026-21391 record describes an improper validation vulnerability within PingAM, where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. This could potentially allow an attacker to bypass authentication controls via spoofing, leading to privilege escalation or impersonation. Defenders responsible for PingAM configurations and authentication controls shoul [truncated]
A role-based access control issue was identified in the administrative expression evaluation functionality of PingFederate. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions. The issue affects PingFederate deployments, where defenders should assess exposure and verify administrative role access to the affected functionality [truncated]
CVE-2025-32736 debrief: Cross-Site Request Forgery in PingFederate Administrative Console. This vulnerability allows actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions. The affected product is PingFederate versions before 13.1. Administrators should assess exposure and prioritize verification and remediation. The vulnerability has a CVSS sco [truncated]
CVE-2026-20746 is a MEDIUM severity vulnerability in Ping Identity PingDirectory. The vulnerability allows authorized users to exhaust the Java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values. The vulnerability was published on 2026-06-12T04:17:04.510Z and last modified on 2026-06-12T16:06:17.027Z.
CVE-2025-20628 describes an insufficient granularity of access control vulnerability in PingIDM (formerly ForgeRock Identity Management). Administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode, allowing attackers to potentially spoof a client-mode RCS and intercept or modify security-relevant properties. This issue is exploitable only when an RCS is [truncated]
