CVE-2026-21391
Improper Claim Validation in PingAM OIDC Provider
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
| CWE | CWE-290 |
| Vendor | ping identity |
| Product | pingam |
| Published | Sep 14, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for ping identity pingam
Be the first to know when new unknown vulnerabilities affecting ping identity pingam are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Ping Identity / PingAM
8.1.0 8.0.0 ≤ 8.0.2 7.5.0 ≤ 7.5.2 7.4.0 ≤ 7.4.2 7.3.0 ≤ 7.3.3 7.2.0 ≤ 7.2.2 7.1.0 ≤ 7.1.4 7.0.0 ≤ 7.0.2 0 < 7.0.0