CVE-2025-32736
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
PingFederate versions before 13.1 have CSRF weaknesses in the Administrative Console that may allow attackers to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
Risk Assessment
Risk of unauthorized changes to system configuration, which could lead to security breaches or service disruptions.
Recommendation
Upgrade PingFederate to version 13.1 or later which includes fixes. Additionally, educate administrators about the risk of clicking suspicious links.
Original NVD description (English source)
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.