CVE-2026-21391— Improper Claim Validation in PingAM OIDC Provider
Quick assessment
Affected
Ping Identity PingAM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PingAM 中存在一个输入校验不当的漏洞，攻击者可以通过构造特定的请求，对任意或受保护的 ID Token 声明（claims）进行设置或覆盖。在特定配置下，该漏洞可能被攻击者利用令牌伪装（spoofing）来绕过身份验证控制，从而导致权限提升或身份冒充。
Possible ATT&CK Techniques 2 AI
T1686 · Disable or Modify System Firewall T1685 · Disable or Modify Tools
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-21391
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Claim Validation in PingAM OIDC Provider
Source: CVE Program / CVE List V5
Vulnerability Description
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ping Identity | PingAM | 8.1.0 | - |
|
II. Public POCs for CVE-2026-21391
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-21391
请登录查看更多情报信息。
Other References for CVE-2026-21391 (1)
IV. Related Vulnerabilities
Same product: PingAM
Same vendor: Ping Identity
-
CVE-2026-20773
Improper Authorization in PingFederate Administrative Expres -
CVE-2025-32736
PingFederate Administrative Console CSRF weaknesses -
CVE-2026-20746
PingDirectory copying of virtual attributes leads to memory -
CVE-2025-20628
Insufficient granularity of access control for Remote Connec -
CVE-2025-27935
Authentication Bypass in OTP (One-time Passcode) IdP Adapter
V. Comments for CVE-2026-21391
No comments yet