QSearchQSearch

CVE-2021-40329

9.8 CRITICAL

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management

Published: 2021-09-27 · Last updated: 2026-06-17

Severity and scoring

CVSS
9.8 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProduct
pingidentitypingfederate

Description

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2021-41770 — Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure (7.5 HIGH)
  • CVE-2021-39270 — In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur (7.5 HIGH)