CVE-2025-27935 — Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying th…
Published: 2025-12-04 · CVSS: 8.6 · CVSS 4.0
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7