CRITICAL 9.5 NVD

CVE-2026-21391

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.

References

https://support.pingidentity.com/s/article/PingAM-Security-Advisory-202603

Published: 2026-09-14 · Source: NVD · Feed updated: 2026-09-15

This critical severity vulnerability with a CVSS score of 9.5 was published on 2026-09-14 via NVD.

Risk Timeline

CVE Disclosed2026-09-14 · 0 days ago

Remediation Resources

Official Advisory

support.pingidentity.com/s/article/PingAM-Security-Advisory-202603

vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.