Identity CVE · Other
CVE-2025-20059PingAM Java Policy Agent path traversal and parameter injection
critical · CVSS 9.2
What broke
The Ping AM Java Policy Agent accepted a relative path and injected parameters a protected app did not expect. CNA CVSS-B 9.2. February 2025. Ping shipped an agent update.
Why it matters
A policy agent is the enforcement point. Bypass it and every application behind it becomes unauthenticated, regardless of how carefully you configured PingAM. This is the agent-side cousin of OAuth2-Proxy skip_auth_routes.
What to do
- Upgrade every Java Policy Agent. Agents drift. Inventory them, do not assume the last AM upgrade covered them.
- Confirm the agent still fails closed on a malformed path. A 404 is acceptable. A skip is not.
Sources
- NVD: CVE-2025-20059
- Ping Identity security advisory, February 2025
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.