CVE-2021-40329: Pingidentity Pingfederate

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.

Affected products

• Pingidentity Pingfederate: before 10.3 (fixed in 10.3)

Published 2021-09-27. Last modified 2026-06-17.