CVE-2026-21391

CriticalCVSS 9.5/10Last modified Sep 18, 2026

Description

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.

Metrics

CVSS 4.0 9.5/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-290

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Ping Identity	PingAM	8.1.0; >= 8.0.0, <= 8.0.2; >= 7.5.0, <= 7.5.2; >= 7.4.0, <= 7.4.2; >= 7.3.0, <= 7.3.3; >= 7.2.0, <= 7.2.2; >= 7.1.0, <= 7.1.4; >= 7.0.0, <= 7.0.2; < 7.0.0

References

https://support.pingidentity.com/s/article/PingAM-Security-Advisory-202603

Timeline

Published: Sep 14, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-213934.8Movable Type contains a stored cross-site scripting vulnerability in Edit Comment. If crafted input is stored by an attacker, arbitrary scri CVE-2026-213996.1Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0 CVE-2026-21408.8A vulnerability was identified in Tenda TX9 up to 22.03.02.10_multi. Affected by this issue is the function sub_4223E0 of the file /goform/s CVE-2026-214006.7Protection mechanism failure for some Intel(R) AI Reference Models before version v3.4.1 within Ring 3: User Applications may allow an escal CVE-2026-214046.3NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. I CVE-2026-214076.8Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring 1: Device Drivers may allow a denial of service. Unprivileged softwar CVE-2026-214085.4beat-access for Windows version 3.0.3 and prior contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Lin CVE-2026-214098.2Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communic CVE-2026-21418.8A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/ja CVE-2026-214109.8InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint ar CVE-2026-214118.7Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authe CVE-2026-214139.8A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b. A