CVE-2026-21391

critical · 9.5

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.

9.5

CVSS

0.6%

EPSS (exploit prob.)

48th

EPSS percentile

2026-09-14

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-290

References

https://support.pingidentity.com/s/article/PingAM-Security-Advisory-202603

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-21391