BaseFortify

Publication date: 2025-12-04

Last updated on: 2025-12-08

Assigner: Ping Identity Corporation

Description

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-04

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-12-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-27935

Affected Vendors & Products

Vendor	Product	Version / Range
pingidentity	pingfederate	4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the OTP Integration Kit for PingFederate, where the system fails to properly validate HTTP methods and authentication state. As a result, the server can advance the authentication process without verifying the one-time password (OTP), effectively bypassing multi-factor authentication.

Impact Analysis

This vulnerability can allow an attacker to bypass multi-factor authentication, potentially gaining unauthorized access to systems or accounts that rely on the OTP Integration Kit for PingFederate for security. This undermines the security of the authentication process and increases the risk of account compromise.

Hi! I’m here to help you understand CVE-2025-27935. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70