CVE-2026-21391
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
- EPSS probability
- 0.45%
- CWE
- CWE-290
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- Ping Identity PingAM
- Ping Identity PingAM
- Ping Identity PingAM
- Ping Identity PingAM
- Ping Identity PingAM
- Ping Identity PingAM
- Ping Identity PingAM
- Ping Identity PingAM
Weakness type
Related vulnerabilities
- CVE-2026-25938 — FUXA Unauthenticated Remote Code Execution in Node-RED Integration
- CVE-2026-27478 — Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation
- CVE-2026-33654 — Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
- CVE-2026-31889 — Shopware has a potential take over of app credentials
- CVE-2026-33661 — WeChat Pay callback signature verification bypassed when Host header is localhost
- CVE-2026-76423 — Cisco ISE API Authentication Bypass Vulnerability
- CVE-2026-6213 — Remote Spark SparkView RCE
- CVE-2026-54782 — CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation