CVE-2026-21391

CVE-2026-21391 is an improper validation vulnerability (CWE-290, authentication bypass by spoofing) in Ping Identity PingAM that allows an unauthenticated remote attacker to set or override arbitrary or protected ID Token claims via a well-crafted request. In configurations where such claims are trusted to drive authentication or authorization decisions, an attacker can spoof identity and bypass authentication controls, resulting in privilege escalation or user impersonation. Exploitation requires no privileges or user interaction and has low attack complexity, but the vulnerable behavior depends on specific deployment configurations (attack prerequisites present). The flaw is rated critical with a CVSS 4.0 score of 9.5. No public proof-of-concept exists and the issue is not on the CISA KEV list, so exploitation in the wild is not currently known.

What to do: Apply the vendor's patched release as specified in the Ping Identity security advisory for CVE-2026-21391. Review any configuration where ID Token claims influence authentication or authorization outcomes (e.g., OIDC claims handling or custom claim-mapping configurations) and restrict or validate which claims can be supplied by an incoming request. Audit logs for anomalous ID Tokens containing unexpected claim overrides, unexpected successful authentications, or privilege changes that could indicate attempted exploitation.