PingAM, PingIDM and PingGateway
CVE-2021-4201: Pre-authentication session hijacking
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Access Management 7.1 | 7.1.1 or later |
| Access Management 6.5 | 6.5.4 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.
Workarounds
Block access to the following endpoints: /authservice /sessionservice /profileservice /policyservice /namingservice /loggingservice
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.