CVE-2025-21085PingFederate 2025 advisory

What broke

CVE-2025-21085 is a PingFederate issue assigned in 2025. Public NVD enrichment was limited when this catalog was compiled. Ping has a long history of federation-plane bugs (client_secret_jwt auth bypass on 11.3, Identifier First Adapter, PingID offline MFA). Do not wait for a perfect NVD page.

Why it matters

PingFederate is an IdP and an OAuth authorization server for a large share of workforce and customer federation. An unpatched PF node is an identity incident waiting on a write-up.

What to do

• Read the Ping advisory that names CVE-2025-21085 and install the build it lists.
• If NVD is still empty, the vendor page is the source of truth. That is the 2026 enrichment reality, not a reason to stall.

After you patch

Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.

• Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
• Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
• Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
• Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of alg: none. See JWT and the validate a JWT recipe.

Sources

• NVD: CVE-2025-21085
• Ping Identity support advisories