Read the docs
TI-2021-18526 Aliases CVE-2021-42000GHSA-f9mp-88cg-ffch

Improper authorization in PingFederate

Priority LOW 30CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.

Summary

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

Why it matters now

EPSS 0.00535 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Ping IdentityPingFederate9.3.3-P15 and later; 10.0.11 and later; 10.1.8 and later; 10.2.6 and later; 10.3.2 and later—No fix listedCNA
  • PingFederate VendorPing Identity Affected 9.3.3-P15 and later; 10.0.11 and later; 10.1.8 and later; 10.2.6 and later; 10.3.2 and later Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:*up to 9.3.0; 10.0.0 – 10.0.11; 10.1.0 – 10.1.8; 10.2.0 – 10.2.6; 10.3.0 – 10.3.2VulnerablePing Identity
cpe:2.3:a:pingidentity:pingfederate:9.3.3:-:*:*:*:*:*:*9.3.3VulnerablePing Identity
cpe:2.3:a:pingidentity:pingfederate:9.3.3:p15:*:*:*:*:*:*9.3.3 p15VulnerablePing Identity
  • cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* Versions up to 9.3.0; 10.0.0 – 10.0.11; 10.1.0 – 10.1.8; 10.2.0 – 10.2.6; 10.3.0 – 10.3.2 Vulnerable ·Ping Identity
  • cpe:2.3:a:pingidentity:pingfederate:9.3.3:-:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Ping Identity
  • cpe:2.3:a:pingidentity:pingfederate:9.3.3:p15:*:*:*:*:*:* Versions 9.3.3 p15 Vulnerable ·Ping Identity

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42000
  2. 2026-10-03 Alias added: GHSA-f9mp-88cg-ffch

References

Advisory 2

  • TI-2023-21350 PingFederate OAuth client_secret_jwt Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-18913 Authentication Bypass via HTML Form & Identifier First Adapter CVSS 3.1CRITICAL 9.8
  • TI-2021-17402 The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain… CVSS 3.1CRITICAL 9.8
  • TI-2022-19358 Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. CVSS 3.1HIGH 8.8
  • TI-2023-20377 Admin Console Denial of Service via Java class enumeration CVSS 3.1HIGH 7.5
  • TI-2022-19356 Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. CVSS 3.1HIGH 7.7
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences