Paper/Archive/CVE-2026-21391

CVE-2026-21391

Ping Identity PingAM — Improper Claim Validation in PingAM OIDC Provider

CVSS 9.5 (CNA)9.5 / 10 × 3028.5 Not in CISA KEV+300.0 EPSS percentile 47.5.475 × 209.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.

Affected

ProductAffectedFixed inSource

PingAM8.1.0–CNA

PingAM8.0.0 – 8.0.2–CNA

PingAM7.5.0 – 7.5.2–CNA

PingAM7.4.0 – 7.4.2–CNA

PingAM7.3.0 – 7.3.3–CNA

PingAM7.2.0 – 7.2.2–CNA

PingAM7.1.0 – 7.1.4–CNA

PingAM7.0.0 – 7.0.2–CNA

PingAM< 7.0.07.0.0CNA

Scores by source

Ping Identity (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refsupport.pingidentity.com/s/article/PingAM-Security-Advisory-202603