VULNERABILITY INTELLIGENCE
CVE-2026-21391
EPSS probability0.58%
CISA KEVNot currently listed
Published2026-09-14
Last modified2026-09-18
Description
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
Weakness classification
- responsible-disclosure@pingidentity.com: CWE-290