CVE-2025-32736: PingFederate Admin Console CSRF Weaknesses
Cross-Site Request Forgery weaknesses in the PingFederate administrative console before version 13.1 allow attackers to perform unauthorized admin actions by getting an authenticated administrator to click a crafted link.
Contents
TL;DR: The administrative console in PingFederate versions before 13.1 has cross-site request forgery weaknesses. An attacker who gets an authenticated admin to click a crafted link can perform unauthorized administrative actions on the PingFederate server. Ping Identity fixed this in PingFederate 13.1.
What happened
PingFederate's administrative web console lacked sufficient CSRF protections on its management endpoints. The console relies on session-based authentication for admins, but the requests to change configuration, manage connections, or alter identity provider mappings did not consistently validate that they originated from the admin's own browser session rather than a third-party site.
Here is how the attack works. An admin with an active PingFederate console session visits a malicious or compromised web page. That page contains a hidden form or JavaScript that submits a POST request to the PingFederate admin console URL, targeting a configuration endpoint. Because the admin's browser automatically attaches the session cookie to the request, PingFederate processes it as a legitimate admin action. The attacker never sees the response, but they can change federation connections, modify OAuth client configurations, or alter authentication policies.
The scope depends on which admin role the victim holds. A user with the "Administrator" role can modify all server configuration. A "User Admin" or "Admin API" role holder has narrower but still dangerous access. Any of these roles, if CSRFed, give the attacker whatever administrative privilege that role grants.
Who is affected
All PingFederate deployments running versions before 13.1. PingFederate is Ping Identity's flagship identity federation server, used by enterprises for single sign-on (SSO), SAML federation, OAuth 2.0 authorization, and OpenID Connect authentication. It sits in front of employee portals, customer-facing applications, and partner integrations for thousands of organizations worldwide, including Fortune 500 companies, financial institutions, and government agencies.
The fix landed in PingFederate 13.1, released in June 2026. Any deployment still on 12.x or earlier remains exposed.
Why it matters
This CVE was published on August 10, 2026, and added to the NVD the same day with CWE-352 classification. NVD has not yet assigned a CVSS score. Ping Identity's release notes for 13.1 reference the fix.
CSRF on an identity provider's admin console is worse than CSRF on a typical web application. PingFederate is the trust anchor for federated authentication across an organization. If an attacker can silently modify federation connections or OAuth client registrations, they can redirect authentication flows to attacker-controlled endpoints, potentially harvesting credentials or tokens from every user who authenticates through that PingFederate instance. The blast radius extends to every application and user that trusts the compromised server.
No known exploitation in the wild has been reported as of publication. The lack of a CVSS score means the severity assessment is still pending.
What to do
Upgrade to PingFederate 13.1 or later. This is the only fully patched version. Download it from the Ping Identity customer portal.
If an immediate upgrade is not possible, apply these mitigations:
- Restrict network access to the PingFederate admin console to internal management networks or VPN-only access. The admin console should never be reachable from the public internet.
- Enforce same-origin policies in any reverse proxy or WAF in front of PingFederate. Block cross-origin POST requests to admin console paths.
- Train admins to use a separate browser profile or dedicated browser instance for PingFederate administration, reducing the chance of visiting a malicious page while an admin session is active.
- Monitor admin console audit logs for unexpected configuration changes. PingFederate logs all administrative actions; unusual changes outside normal maintenance windows warrant investigation.
After upgrading, verify that the admin console now validates CSRF tokens on all state-changing requests. PingFederate 13.1 added anti-CSRF tokens to its admin console forms.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.