0
CVE-2025-26862
- EPSS 0.34%
- Veröffentlicht 27.10.2025 14:39:41
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle responsible-disclosure@pingide
- CVE-Watchlists
- Unerledigt
PingFederate unexpected browser flow initiation in redirectless mode
Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPing Identity
≫
Produkt
PingFederate
Default Statusunaffected
Version
11.3.0
Version <
11.3.14
Status
affected
Version
12.0.0
Version <
12.0.10
Status
affected
Version
12.1.0
Version <
12.1.9
Status
affected
Version
12.2.0
Version <
12.2.6
Status
affected
Version
12.3.0
Version <
12.3.3
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.34% | 0.258 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| responsible-disclosure@pingidentity.com | 0 | 0 | 0 |
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber
|
CWE-307 Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
https://www.pingidentity.com/en/resources/downloads/pingfederate.html
https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode