CVE-2025-32736

Received Received - Intake

Cross-Site Request Forgery in PingFederate Admin Console

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Ping Identity Corporation

Description

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2025-32736

Affected Vendors & Products

Vendor	Product	Version / Range
pingidentity	pingfederate	to 13.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) weakness in the Administrative Console of PingFederate versions before 13.1. It allows attackers to trick administrators with active sessions into clicking specially-crafted links, which can then perform unauthorized actions on their behalf.

Impact Analysis

If exploited, this vulnerability could allow attackers to gain unauthorized access to administrative functions, potentially leading to data breaches, unauthorized configuration changes, or other malicious activities within the PingFederate system.

Compliance Impact

This vulnerability could lead to unauthorized access or modifications, potentially violating compliance requirements such as GDPR (data protection) or HIPAA (healthcare data security). Organizations using affected versions may face regulatory penalties or reputational damage.

Mitigation Strategies

Upgrade PingFederate to version 13.1 or later to address the Cross-Site Request Forgery weaknesses in the Administrative Console.

Hi! I’m here to help you understand CVE-2025-32736. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70