VulnerabilityDeferred

CVE-2025-27935

The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.

HIGH 8.6EPSS 0.51%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-306
Source: responsible-disclosure@pingidentity.com

References

https://support.pingidentity.com/s/article/SECADV051-PingFederate-OTP-Integration-Kit-authentication-bypass
https://www.pingidentity.com/en/resources/downloads/pingfederate.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.