CVE-2025-27935CWE-306

CVE-2025-27935

published December 5, 2025

CVSS

8.6

EPSS

Percentile

42.6

In the wild

Unconfirmed

What it is

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.

The record

Technical detail

CVSS: 8.6 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00509 · 42.6th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2025-12-05T02:16Z

References (2)

https://support.pingidentity.com/s/article/SECADV051-PingFederate-OTP-Integration-Kit-authentication-bypass · [email protected]https://www.pingidentity.com/en/resources/downloads/pingfederate.html · [email protected]

EPSS history

Timeline

04 DEC 20:38Z
Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit
cvelistv5