Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2025-21085PingFederate 2025 advisory

high
Product: PingFederateVendor: Ping IdentityDisclosed: 2025-03-01Status: PatchedProtocol deep diveNVD ↗

What broke

CVE-2025-21085 is a PingFederate issue assigned in 2025. Public NVD enrichment was limited when this catalog was compiled. Ping has a long history of federation-plane bugs (client_secret_jwt auth bypass on 11.3, Identifier First Adapter, PingID offline MFA). Do not wait for a perfect NVD page.

Why it matters

PingFederate is an IdP and an OAuth authorization server for a large share of workforce and customer federation. An unpatched PF node is an identity incident waiting on a write-up.

What to do

  • Read the Ping advisory that names CVE-2025-21085 and install the build it lists.
  • If NVD is still empty, the vendor page is the source of truth. That is the 2026 enrichment reality, not a reason to stall.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.