PingFederate and PingAccess
CVE-2024-23983: Access rules for PingAccess may be circumvented with URL-encoded characters
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityMEDIUMCVSS 4.0 5.8
EPSS0.43%Chance of exploitation in 30 days
Public exploitNot tracked
FixAvailable
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| PingAccess 8.1 | 8.1.1 or later |
| PingAccess 8.0 | 8.0.4 or later |
| PingAccess 7.3 | 7.3.5 or later |
| PingAccess 7.2 | 7.2.4 or later |
| PingAccess 7.1 | 7.1.5 or later |
| PingAccess 7.0 | 7.0.8 or later |
| PingAccess 6.0 | 6.3.9 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.