CVE-2025-27935 HIGH

CVE-2025-27935: Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit

Vendor Ping Identity
Product One-Time Passcode Integration Kit for PingFederate
Weakness CWE-306 · Missing auth
Published December 4, 2025
Last update December 5, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.

Key dates

02Disclosure timeline

December 4, 2025 CVE published
December 5, 2025 Record updated