Security Advisory

CVE-2025-27935

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-12-04 20:38:31

Last updated 2025-12-05 17:33:20

Assigner Ping Identity

CVSS score 8.6

State PUBLISHED

Description

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.

← Browse all CVEs View on cve.org ↗