Start with Identity
Identity CVE · Other

CVE-2025-20059PingAM Java Policy Agent path traversal and parameter injection

critical · CVSS 9.2
Product: PingAM Java Policy AgentVendor: Ping IdentityDisclosed: 2025-02-12Status: PatchedNVD ↗

What broke

The Ping AM Java Policy Agent accepted a relative path and injected parameters a protected app did not expect. CNA CVSS-B 9.2. February 2025. Ping shipped an agent update.

Why it matters

A policy agent is the enforcement point. Bypass it and every application behind it becomes unauthenticated, regardless of how carefully you configured PingAM. This is the agent-side cousin of OAuth2-Proxy skip_auth_routes.

What to do

  • Upgrade every Java Policy Agent. Agents drift. Inventory them, do not assume the last AM upgrade covered them.
  • Confirm the agent still fails closed on a malformed path. A 404 is acceptable. A skip is not.

After you patch

Patching closes the entry point. It does not remove access an attacker established through it.

  • Revoke sessions and API tokens on the affected system rather than only resetting passwords.
  • Audit accounts, tokens, and administrative changes made during the exposure window.
  • Rotate credentials the system stored or could reach, including directory service accounts and integration keys. See secrets rotation.
  • Treat the system as a pivot: whatever it could authenticate to is in scope until you have checked it.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research
Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.