CVE-2026-21391

CVSS 9.5 (critical) · published 2026-09-14

An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.

Weakness: CWE-290

Source: NVD CVE-2026-21391

References

• https://support.pingidentity.com/s/article/PingAM-Security-Advisory-202603

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.