CVE-2026-21391 Improper Claim Validation in PingAM OIDC Provider
Attackers can spoof ID Token claims to bypass authentication and escalate privileges in specific PingAM configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-21391?
CVE-2026-21391 is a critical authentication bypass vulnerability in PingAM, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
Weakness: CWE-290
Which versions are affected by CVE-2026-21391?
How do I fix CVE-2026-21391?
No fix has been published for CVE-2026-21391 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-21391 being exploited?
There is no known exploitation of CVE-2026-21391 in the wild and no public exploit code.
Sources
Also known as GHSA-cvq5-qf5h-v345.