CVE-2025-26862CWE-307

CVE-2025-26862

published October 27, 2025

CVSS
0.0
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.

The record
Technical detail
CVSS
0.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-10-27T19:15Z
References (2)
https://support.pingidentity.com/s/article/PingFederate-unexpected-template-rendering-in-redirectless-mode · [email protected]https://www.pingidentity.com/en/resources/downloads/pingfederate.html · [email protected]
EPSS history
Timeline
  • 27 OCT 14:39Z
    PingFederate unexpected browser flow initiation in redirectless mode
    cvelistv5