PingFederate and PingAccess
CVE-2025-27935: Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityHIGHCVSS 4.0 8.6
EPSS0.51%Chance of exploitation in 30 days
Public exploitNot tracked
FixSee advisory
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| One-Time Passcode Integration Kit for PingFederate 1.0 to 1.1 | Upgrade past 1.1; see the advisory |
| One-Time Passcode Integration Kit for PingFederate 1.1 | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.