Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
Priority LOW 37CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ping Identity | PingFederate | 13.0.0 – 13.0.1; 12.3.0 – 12.3.5; 12.2.0 – 12.2.7; 12.1.0 – 12.1.10; 12.0.0 – 12.0.10; 11.3.0 – 11.3.14 | — | No fix listed | CNA |
- PingFederate VendorPing Identity Affected 13.0.0 – 13.0.1; 12.3.0 – 12.3.5; 12.2.0 – 12.2.7; 12.1.0 – 12.1.10; 12.0.0 – 12.0.10; 11.3.0 – 11.3.14 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* | — | — | Ping Identity |
- cpe:2.3:a:pingidentity:pingfederate:*:*:*:*:*:*:*:* Versions — — ·Ping Identity
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-20773
- 2026-10-03 Alias added: GHSA-xffc-pg4j-3qv4
References
More Ping Identity vulnerabilities
- TI-2018-15786 UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to… CVSS 3.0CRITICAL 9.8
- TI-2020-08561 Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled… CVSS 3.1CRITICAL 9.8
- TI-2025-14368 PingAM Java Policy Agent path traversal CVSS 4.0CRITICAL 9.2
- TI-2023-21350 PingFederate OAuth client_secret_jwt Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2026-17292 Improper Claim Validation in PingAM OIDC Provider CVSS 4.0CRITICAL 9.5
- TI-2023-20828 PingFederate PingID Radius PCV Authentication Bypass CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-20773 · CVE Program
- CVE-2026-20773 · NVD
- FIRST EPSS
- GHSA-xffc-pg4j-3qv4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences