Pingidentity

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Pingidentity product.

RSS Feeds for Pingidentity security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Pingidentity products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Pingidentity Sorted by Most Security Vulnerabilities since 2018

Pingidentity Pingfederate21 vulnerabilities

Pingidentity Pingid Integration Windows Login8 vulnerabilities

Pingidentity Pingone Mfa Integration Kit2 vulnerabilities

Pingidentity Pingid Windows Login2 vulnerabilities

Pingidentity Pingid2 vulnerabilities

Pingidentity Pingid Integration Kit2 vulnerabilities

Pingidentity Pingid Desktop1 vulnerability

Pingidentity Self Service Account Manager1 vulnerability

Pingidentity Rsa Securid Integration Kit1 vulnerability

Pingidentity Radius Pcv1 vulnerability

Pingidentity Pingid Ssh Integration1 vulnerability

Pingidentity Pingid Radius Pcv1 vulnerability

Pingidentity Agentless Integration Kit1 vulnerability

Pingidentity Pingid Adapter Pingfederate1 vulnerability

Pingidentity Pingdirectory1 vulnerability

Pingidentity Pingcentral1 vulnerability

Pingidentity Pingaccess1 vulnerability

Pingidentity Ldapsdk1 vulnerability

Pingidentity Desktop1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in Pingidentity. Last year, in 2025 Pingidentity had 4 security vulnerabilities published. Right now, Pingidentity is on track to have less security vulnerabilities in 2026 than it did last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	4	0.00
2024	6	7.05
2023	11	6.77
2022	14	6.61
2021	4	7.53
2020	1	9.80
2019	1	0.00
2018	1	9.80

It may take a day or so for new Pingidentity vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Pingidentity Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-26862	Oct 27, 2025	PingFederate Brute-Force Risk via Auth Form in Redirectless Mode Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.	Pingfederate
CVE-2024-25573	Jun 15, 2025	PingFederate Admin Console XSS via Unsanitized User Data Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.	Pingfederate
CVE-2025-22854	Jun 15, 2025	Thread Exhaustion via Non-200 HTTP in PingFederate Google Adapter Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.	Pingfederate
CVE-2025-21085	Jun 15, 2025	PingFederate OAuth2 Grant Duplication Causes Memory Overuse PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.	Pingfederate
CVE-2024-21832	Jul 09, 2024	JSON Injection in PingFederate REST API POST A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body.	Pingfederate
CVE-2024-22377	Jul 09, 2024	PingFederate Deploy Dir Unauthorized Access on Runtime Nodes The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.	Pingfederate
CVE-2024-22477	Jul 09, 2024	Admin Console OIDC Policy Editor XSS for admin users A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.	Pingfederate
CVE-2023-40148	Apr 10, 2024	PingFederate SSRF allows unauthenticated POST requests Server-side request forgery (SSRF) in PingFederate allows unauthenticated http requests to attack network resources and consume server-side resources via forged HTTP POST requests.	Pingfederate
CVE-2023-40545	Feb 06, 2024	Keycloak 11.3 OAuth2 client_secret_jwt Auth Bypass Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.	Pingfederate
CVE-2023-36496	Feb 01, 2024	Delegate Admin Privilege Escalation via Virtual Attr Provider (OpenDJ) Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server.	Pingdirectory
CVE-2023-39231	Oct 25, 2023	PingFederate MFA Adapter Device Pairing Bypass (CVE-2023-39231) PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials.	Pingone Mfa Integration Kit Pingfederate
CVE-2023-39930	Oct 25, 2023	PingFederate MSCHAP RADIUS Auth Bypass via Malcrafted Radius Client A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request.	Pingid Radius Pcv Pingfederate
CVE-2023-34085	Oct 25, 2023	AWS DynamoDB Unauthorized Data Leak via Crafted Table Request When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request	Pingfederate
CVE-2023-37283	Oct 25, 2023	PingFederate Identifier First Adapter Auth Bypass Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter	Pingfederate
CVE-2023-39219	Oct 25, 2023	PingFederate Admin Console ClassLoading Enum DoS PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests	Pingfederate
CVE-2022-23721	Apr 25, 2023	PingID for Windows <2.9 username collision via duplicate usernames PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times.	Pingid Integration Windows Login
CVE-2022-40722	Apr 25, 2023	PingID Adapter for PingFederate: RSA padding misconfig bypasses offline MFA A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.	Pingid Integration Kit Pingfederate Pingid Adapter Pingfederate And others...
CVE-2022-40723	Apr 25, 2023	PingID RADIUS Adapter MFA Bypass in PingFederate The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.	Pingid Integration Kit Pingfederate Radius Pcv And others...
CVE-2022-40724	Apr 25, 2023	PingFederate CSRF via crafted GET request The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.	Pingfederate
CVE-2022-40725	Apr 25, 2023	PingID Desktop - PIN Attempt Bypass in versions < 1.7.4 PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.	Desktop
CVE-2018-25084	Apr 10, 2023	Ping Identity SSAM 1.1.2 XSS Remote (SSAMController) Fixed in 1.1.3 A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.	Self Service Account Manager
CVE-2022-23726	Sep 30, 2022	PingCentral: Admin Auth Can Expose Sensitive Data via Actuator PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.	Pingcentral
CVE-2022-23720	Jun 30, 2022	PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, such as those typically used by PingFederate, into PingID Windows Login user endpoints. Using sensitive full permissions properties file outside of a privileged trust boundary leads to an increased risk of exposure or discovery, and an attacker could leverage these credentials to perform administrative actions against PingID APIs or endpoints.	Pingid Integration Windows Login
CVE-2022-23717	Jun 30, 2022	PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication. PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication.	Pingid Integration Windows Login
CVE-2022-23718	Jun 30, 2022	PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophisticated man-in-the-middle position, or to compromise Ping Identity web servers, could deliver malicious code that would be executed as SYSTEM by the PingID Windows Login application.	Pingid Integration Windows Login
CVE-2022-23719	Jun 30, 2022	PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.	Pingid Integration Windows Login
CVE-2022-23725	Jun 30, 2022	PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances. PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances.	Pingid Integration Windows Login
CVE-2022-23724	May 04, 2022	Use of static encryption key material allows forging an authentication token to other users within a tenant organization Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials.	Pingid Integration Windows Login
CVE-2022-23723	May 02, 2022	An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow. An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow.	Pingone Mfa Integration Kit
CVE-2022-23722	May 02, 2022	When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing userâs password.	Pingfederate
CVE-2021-41994	Apr 30, 2022	A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.	Pingid Windows Login Pingid
CVE-2021-42001	Apr 30, 2022	PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.	Pingid Desktop
CVE-2021-41993	Apr 30, 2022	A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.	Pingid Pingid Windows Login
CVE-2021-41992	Apr 30, 2022	A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.	Pingid Integration Windows Login
CVE-2021-42000	Feb 10, 2022	When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.	Pingfederate
CVE-2021-41770	Oct 07, 2021	Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.	Pingfederate
CVE-2021-40329	Sep 27, 2021	The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.	Pingfederate
CVE-2021-31923	Sep 24, 2021	Ping Identity PingAccess before 5.3.3 Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.	Pingaccess
CVE-2021-39270	Aug 18, 2021	In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.	Rsa Securid Integration Kit
CVE-2020-10654	May 13, 2020	Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a Remote Code Execution vector on the authenticating endpoint.	Pingid Ssh Integration
CVE-2019-13564	Jul 11, 2019	XSS exists in Ping Identity Agentless Integration Kit before 1.5. XSS exists in Ping Identity Agentless Integration Kit before 1.5.	Agentless Integration Kit
CVE-2018-1000134	Mar 16, 2018	UnboundID LDAP SDK version UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.	Ldapsdk