# cve.now: Ping Identity

The newest entries naming Ping Identity as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-80327](https://cve.now/CVE-2026-80327.md): Open Redirect in PingGateway Fragment Filter (CVSS 5.1)
- [CVE-2026-21391](https://cve.now/CVE-2026-21391.md): Improper Claim Validation in PingAM OIDC Provider (CVSS 9.5)
- [CVE-2026-20773](https://cve.now/CVE-2026-20773.md): Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint (CVSS 8.5)
- [CVE-2025-32736](https://cve.now/CVE-2025-32736.md): PingFederate Administrative Console CSRF weaknesses (CVSS 4.9)
- [CVE-2026-20746](https://cve.now/CVE-2026-20746.md): PingDirectory copying of virtual attributes leads to memory exhaustion (CVSS 6.3)
- [CVE-2025-20628](https://cve.now/CVE-2025-20628.md): Insufficient granularity of access control for Remote Connector Servers in client mode (CVSS 6.9)
- [CVE-2025-27935](https://cve.now/CVE-2025-27935.md): Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit (CVSS 8.6)
- [CVE-2025-26862](https://cve.now/CVE-2025-26862.md): PingFederate unexpected browser flow initiation in redirectless mode (CVSS 0.0)
- [CVE-2024-25573](https://cve.now/CVE-2024-25573.md): Stored Cross-Site Scripting in Administrative Console Context (CVSS 6.9)
- [CVE-2025-22854](https://cve.now/CVE-2025-22854.md): Possible thread exhaustion from processing http responses in PingFederate Google Adapter (CVSS 6.9)
- [CVE-2025-21085](https://cve.now/CVE-2025-21085.md): PingFederate OAuth Grant attribute duplication may use excessive memory (CVSS 2.1)
- [CVE-2025-20059](https://cve.now/CVE-2025-20059.md): PingAM Java Policy Agent path traversal (CVSS 9.2)
- [CVE-2024-23983](https://cve.now/CVE-2024-23983.md): Access rules for PingAccess may be circumvented with URL-encoded characters (CVSS 5.8)
- [CVE-2024-25566](https://cve.now/CVE-2024-25566.md): Open Redirect in PingAM (CVSS 5.1)
- [CVE-2024-23600](https://cve.now/CVE-2024-23600.md): PingIDM Query Filter Vulnerability (CVSS 2.7)
- [CVE-2024-21832](https://cve.now/CVE-2024-21832.md): PingFederate REST API Data Store Injection (CVSS 3.5)
- [CVE-2024-22377](https://cve.now/CVE-2024-22377.md): PingFederate Runtime Node Path Traversal (CVSS 5.3)
- [CVE-2024-22477](https://cve.now/CVE-2024-22477.md): PingFederate OIDC Policy Management Editor Cross-Site Scripting (CVSS 1.8)
- [CVE-2023-40356](https://cve.now/CVE-2023-40356.md): PingOne MFA Integration Kit MFA bypass (CVSS 8.7)
- [CVE-2023-40702](https://cve.now/CVE-2023-40702.md): PingOne MFA Integration Kit MFA bypass (CVSS 7.7)
- [CVE-2024-23316](https://cve.now/CVE-2024-23316.md): PingAccess HTTP Request Desynchronization Weakness (CVSS 8.8)
- [CVE-2023-40148](https://cve.now/CVE-2023-40148.md): PingFederate Server Side Request Forgery vulnerability (CVSS 6.5)
- [CVE-2023-40545](https://cve.now/CVE-2023-40545.md): PingFederate OAuth client\_secret\_jwt Authentication Bypass (CVSS 8.8)
- [CVE-2023-36496](https://cve.now/CVE-2023-36496.md): Delegated Admin Virtual Attribute Provider Privilege Escalation (CVSS 7.7)
- [CVE-2023-34085](https://cve.now/CVE-2023-34085.md): User Attribute Disclosure via DynamoDB Data Stores (CVSS 2.6)
- [CVE-2023-39219](https://cve.now/CVE-2023-39219.md): Admin Console Denial of Service via Java class enumeration (CVSS 7.5)
- [CVE-2023-37283](https://cve.now/CVE-2023-37283.md): Authentication Bypass via HTML Form & Identifier First Adapter (CVSS 8.1)
- [CVE-2023-39930](https://cve.now/CVE-2023-39930.md): PingFederate PingID Radius PCV Authentication Bypass (CVSS 7.5)
- [CVE-2023-39231](https://cve.now/CVE-2023-39231.md): PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass (CVSS 7.3)
- [CVE-2022-40725](https://cve.now/CVE-2022-40725.md): PingID Desktop PIN attempt lockout bypass. (CVSS 7.3)
- [CVE-2022-40724](https://cve.now/CVE-2022-40724.md): Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. (CVSS 6.4)
- [CVE-2022-40723](https://cve.now/CVE-2022-40723.md): Configuration-based MFA Bypass in PingID RADIUS PCV. (CVSS 6.5)
- [CVE-2022-40722](https://cve.now/CVE-2022-40722.md): Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. (CVSS 7.7)
- [CVE-2022-23721](https://cve.now/CVE-2022-23721.md): PingID integration for Windows login duplicate username collision. (CVSS 3.8)
- [CVE-2018-25084](https://cve.now/CVE-2018-25084.md): Ping Identity Self-Service Account Manager SSAMController.java cross site scripting (CVSS 3.5)
- [CVE-2022-23726](https://cve.now/CVE-2022-23726.md): PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amo (CVSS 5.4)
- [CVE-2022-23725](https://cve.now/CVE-2022-23725.md): PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances (CVSS 7.7)
- [CVE-2022-23720](https://cve.now/CVE-2022-23720.md): PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file (CVSS 7.5)
- [CVE-2022-23719](https://cve.now/CVE-2022-23719.md): PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests (CVSS 7.2)
- [CVE-2022-23718](https://cve.now/CVE-2022-23718.md): PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution (CVSS 7.6)
- [CVE-2022-23717](https://cve.now/CVE-2022-23717.md): PingID Windows Login prior to 2.8 denial of service condition (CVSS 5.0)
- [CVE-2021-41995](https://cve.now/CVE-2021-41995.md): PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks (CVSS 7.7)
- [CVE-2022-23724](https://cve.now/CVE-2022-23724.md): PingID Integration for Windows Login MFA Bypass (CVSS 6.4)
- [CVE-2022-23723](https://cve.now/CVE-2022-23723.md): PingFederate PingOneMFA Integration Kit MFA Bypass (CVSS 7.7)
- [CVE-2022-23722](https://cve.now/CVE-2022-23722.md): PingFederate Password Reset via Authentication API Mishandling (no CVSS)
- [CVE-2021-42001](https://cve.now/CVE-2021-42001.md): PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure (CVSS 8.0)
- [CVE-2021-41994](https://cve.now/CVE-2021-41994.md): PingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks (CVSS 6.6)
- [CVE-2021-41993](https://cve.now/CVE-2021-41993.md): PingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacks (CVSS 6.6)
- [CVE-2021-41992](https://cve.now/CVE-2021-41992.md): PingID Windows Login RSA cryptographic weakness with possible offline MFA bypass (CVSS 7.7)
- [CVE-2021-42000](https://cve.now/CVE-2021-42000.md): Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows (CVSS 5.3)
- [CVE-2021-40329](https://cve.now/CVE-2021-40329.md): The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. (no CVSS)
- [CVE-2021-31923](https://cve.now/CVE-2021-31923.md): Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation. (no CVSS)
- [CVE-2021-39270](https://cve.now/CVE-2021-39270.md): In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ping-identity
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.