BaseFortify

Publication date: 2025-10-27

Last updated on: 2025-10-30

Assigner: Ping Identity Corporation

Description

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-26862

EUVD

EUVD-2025-36181

Affected Vendors & Products

Vendor	Product	Version / Range
pingidentity	pingfederate	4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability involves the HTML Form Adapter in PingFederate when using only the non-default redirectless mode. It causes unexpected rendering of the authentication form, which allows authentication attempts that may enable brute force login attacks. [1]

Impact Analysis

The vulnerability can allow attackers to perform brute force login attacks by exploiting the unexpected authentication form rendering. This could lead to unauthorized access if attackers successfully guess credentials. [1]

Hi! I’m here to help you understand CVE-2025-26862. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70