CVE-2025-26862

UnknownCVSS 0.0

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.

Risk Assessment

Risk of unauthorized access through brute force login attacks, potentially leading to account takeover.

Recommendation

Update PingFederate to a patched version or configure the default redirect mode to avoid unexpected form rendering.

Other vulnerabilities in PingFederate

CVE-2025-32736Medium
PingFederate versions before 13.1 have CSRF weaknesses in the Administrative Console that may allow attackers to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.

Original NVD description (English source)

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS