CVE-2025-26862

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-26862", "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "state": "PUBLISHED", "assignerShortName": "Ping Identity", "dateReserved": "2025-04-16T01:21:55.185Z", "datePublished": "2025-10-27T14:39:41.284Z", "dateUpdated": "2025-10-27T14:48:11.544Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["HTML Form Adapter"], "product": "PingFederate", "vendor": "Ping Identity", "versions": [{"lessThan": "11.3.14", "status": "affected", "version": "11.3.0", "versionType": "custom"}, {"lessThan": "12.0.10", "status": "affected", "version": "12.0.0", "versionType": "custom"}, {"lessThan": "12.1.9", "status": "affected", "version": "12.1.0", "versionType": "custom"}, {"lessThan": "12.2.6", "status": "affected", "version": "12.2.0", "versionType": "custom"}, {"lessThan": "12.3.3", "status": "affected", "version": "12.3.0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "versionEndExcluding": "11.3.14", "versionStartIncluding": "11.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "versionEndExcluding": "12.0.10", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "versionEndExcluding": "12.1.9", "versionStartIncluding": "12.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "versionEndExcluding": "12.2.6", "versionStartIncluding": "12.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks."}], "value": "Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks."}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}, {"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 0, "baseSeverity": "NONE", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "shortName": "Ping Identity", "dateUpdated": "2025-10-27T14:39:41.284Z"}, "references": [{"url": "https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode"}, {"url": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html"}], "source": {"discovery": "UNKNOWN"}, "title": "PingFederate unexpected browser flow initiation in redirectless mode", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T14:48:01.060548Z", "id": "CVE-2025-26862", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T14:48:11.544Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-26862", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T14:48:01.060548Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T14:48:04.903Z"}}], "cna": {"title": "PingFederate unexpected browser flow initiation in redirectless mode", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112 Brute Force"}]}, {"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 0, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/RE:L/U:Amber", "providerUrgency": "AMBER", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ping Identity", "modules": ["HTML Form Adapter"], "product": "PingFederate", "versions": [{"status": "affected", "version": "11.3.0", "lessThan": "11.3.14", "versionType": "custom"}, {"status": "affected", "version": "12.0.0", "lessThan": "12.0.10", "versionType": "custom"}, {"status": "affected", "version": "12.1.0", "lessThan": "12.1.9", "versionType": "custom"}, {"status": "affected", "version": "12.2.0", "lessThan": "12.2.6", "versionType": "custom"}, {"status": "affected", "version": "12.3.0", "lessThan": "12.3.3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode"}, {"url": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.", "supportingMedia": [{"type": "text/html", "value": "Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307 Improper Restriction of Excessive Authentication Attempts"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.3.14", "versionStartIncluding": "11.3.0"}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.0.10", "versionStartIncluding": "12.0.0"}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.1.9", "versionStartIncluding": "12.1.0"}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.2.6", "versionStartIncluding": "12.2.0"}, {"criteria": "cpe:2.3:a:ping_identity:pingfederate:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.3.0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "shortName": "Ping Identity", "dateUpdated": "2025-10-27T14:39:41.284Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26862", "state": "PUBLISHED", "dateUpdated": "2025-10-27T14:48:11.544Z", "dateReserved": "2025-04-16T01:21:55.185Z", "assignerOrgId": "5998a2e9-ae88-42cd-b6e0-7564fd979f9e", "datePublished": "2025-10-27T14:39:41.284Z", "assignerShortName": "Ping Identity"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["HTML Form Adapter"], "product": "PingFederate", "vendor": "Ping Identity", "versions": [{"lessThan": "11.3.14", "status": "affected", "version": "11.3.0", "versionType": "custom"}, {"lessThan": "12.0.10", "status": "affected", "version": "12.0.0", "versionType": "custom"}, {"lessThan": "12.1.9", "status": "affected", "version": "12.1.0", "versionType": "custom"}, {"lessThan": "12.2.6", "status": "affected", "version": "12.2.0", "versionType": "custom"}, {"lessThan": "12.3.3", "status": "affected", "version": "12.3.0", "versionType": "custom"}]}], "source": "responsible-disclosure@pingidentity.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks."}, {"lang": "es", "value": "Renderizado inesperado del formulario de autenticaci\u00f3n en el Adaptador de Formulario HTML usando solo el modo sin redirecci\u00f3n no predeterminado en PingFederate permite intentos de autenticaci\u00f3n que pueden habilitar ataques de inicio de sesi\u00f3n por fuerza bruta."}], "id": "CVE-2025-26862", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 0.0, "baseSeverity": "NONE", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "AMBER", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "responsible-disclosure@pingidentity.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-26862", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T14:48:01.060548Z", "version": "2.0.3"}}]}, "published": "2025-10-27T15:15:37.800", "references": [{"source": "responsible-disclosure@pingidentity.com", "url": "https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode"}, {"source": "responsible-disclosure@pingidentity.com", "url": "https://www.pingidentity.com/en/resources/downloads/pingfederate.html"}], "sourceIdentifier": "responsible-disclosure@pingidentity.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "responsible-disclosure@pingidentity.com", "type": "Secondary"}]}

{}

{"created": "2025-10-27T22:03:38.511585+00:00", "updated": "2025-10-27T22:03:38.511611+00:00", "vendors": ["pingidentity", "pingidentity$PRODUCT$pingfederate"]}