CVE-2026-21391

Improper Claim Validation in PingAM OIDC Provider

State: Published
Severity: 9.5 Critical
Published: Sep 14, 2026
Updated: Sep 14, 2026
Reserved: Jan 7, 2026

Description

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.

Scores

CVSS	Score	Vector	Source
4.0	9.5 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N	Ping Identity

Weaknesses

CWE-290 Authentication bypass by spoofing

Affected Products

Product	Versions
PingAMPing Identity	8.1.0Affected 8.0.0 through 8.0.2Affected 7.5.0 through 7.5.2Affected 7.4.0 through 7.4.2Affected 7.3.0 through 7.3.3Affected 7.2.0 through 7.2.2Affected 7.1.0 through 7.1.4Affected 7.0.0 through 7.0.2Affected before 7.0.0Affectedfrom 0Affected

References

https://support.pingidentity.com/s/article/PingAM-Security-Advisory-202603

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.