CVE-2026-21391: PingAM Authentication Bypass Vulnerability

CVE-2026-21391 Overview

CVE-2026-21391 is an improper validation vulnerability in Ping Identity's PingAM access management platform. A well-crafted request allows an attacker to set or override arbitrary or protected ID Token claims. In vulnerable configurations, this bypasses authentication controls through spoofing and enables privilege escalation or user impersonation. The flaw is classified as [CWE-290: Authentication Bypass by Spoofing] and stems from insufficient validation of client-supplied claim data during OpenID Connect token issuance. Because ID Tokens are trusted by downstream relying parties, an attacker who forges high-privilege claims can impersonate administrative or service accounts across federated applications.

Critical Impact
An unauthenticated network attacker can override protected ID Token claims to impersonate arbitrary users and escalate privileges across federated applications relying on PingAM.

Affected Products

PingAM (Ping Identity Access Management)
OpenID Connect / OAuth 2.0 token issuance flows within PingAM
Downstream relying parties consuming PingAM-issued ID Tokens

Discovery Timeline

2026-09-14 - CVE-2026-21391 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-21391

Vulnerability Analysis

The vulnerability affects how PingAM constructs OpenID Connect ID Tokens during authentication flows. PingAM fails to enforce a strict allow-list boundary between claims that clients may influence and claims that must be authoritative from the identity provider. Attackers can submit a crafted request containing claim values that PingAM merges into the signed ID Token payload without proper validation.

Protected claims include identity assertions such as sub, groups, roles, and custom authorization attributes. When these are overridden, the token remains cryptographically valid because PingAM signs it after the injection occurs. Relying parties then honor the forged claims as authoritative statements from the identity provider.

Root Cause

The root cause is missing or incomplete server-side validation of claim inputs during token assembly. The token issuance logic does not distinguish between client-supplied optional claims and reserved claims that must originate from the authenticated session context. This maps to [CWE-290] because the attacker spoofs an authenticated identity by manipulating trusted identity assertions.

Attack Vector

The attack requires network access to the PingAM authorization endpoints and no prior authentication. An attacker crafts an OpenID Connect authorization or token request containing additional or overridden claim parameters targeting protected fields. PingAM accepts these parameters and emits a signed ID Token reflecting the attacker-controlled values. The attacker then presents the token to any relying party that trusts the PingAM issuer, gaining the identity or privileges encoded in the forged claims. See the PingIdentity Security Advisory 202603 for configuration-specific technical details.

Detection Methods for CVE-2026-21391

Indicators of Compromise

ID Tokens issued by PingAM containing claim values that do not match the authenticated user's directory attributes.
Authentication events where the sub claim in an issued token differs from the authenticated principal recorded in PingAM session logs.
OpenID Connect authorization or token requests containing unexpected claim parameters in the request body or query string.
Downstream application access by accounts that never completed a valid PingAM authentication event.

Detection Strategies

Compare issued ID Token claims against the authenticated session record in PingAM audit logs to detect divergence.
Alert on OAuth or OIDC requests that include reserved claim names such as sub, groups, roles, or azp as request parameters.
Correlate relying party access logs with PingAM issuance logs to identify tokens accepted for users with no corresponding authentication.

Monitoring Recommendations

Ingest PingAM authentication, authorization, and token issuance logs into a centralized SIEM with retention sufficient for incident response.
Baseline expected claim structures per relying party and alert on deviations, including newly appearing claims or unexpected role values.
Monitor for privilege escalation patterns immediately following token issuance events from PingAM.

How to Mitigate CVE-2026-21391

Immediate Actions Required

Apply the vendor-supplied patch referenced in PingIdentity Security Advisory 202603 as the primary remediation.
Audit PingAM OpenID Connect client configurations to identify clients that accept or forward custom claim parameters.
Rotate signing keys and invalidate active sessions after patching to eliminate any tokens issued during the exposure window.
Review relying party access logs for suspicious authentications originating from PingAM during the vulnerable period.

Patch Information

Ping Identity has published remediation guidance in PingIdentity Security Advisory 202603. Administrators should consult the advisory for the fixed PingAM version numbers applicable to their deployment and apply the update on an accelerated schedule given the network-exploitable nature of the flaw.

Workarounds

Restrict network access to PingAM authorization and token endpoints to trusted networks and reverse proxies where feasible.
Configure relying parties to validate critical claims against an authoritative directory before granting privileged actions.
Disable or tightly restrict OIDC clients that accept dynamic claim parameters until the patch is applied.

bash

# Configuration example
# Consult PingIdentity Security Advisory 202603 for authoritative
# configuration guidance specific to your PingAM version.