{"id":"CVE-2025-32736","title":"Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.","summary":"Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.","severity":"none","cwe":["CWE-352"],"published":"2026-08-10","updated":"2026-09-09","sourceUpdated":"2026-09-09T15:52:04.827","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-32736","references":[{"url":"https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes.html#pingfederate-13-1-june-2026","label":"responsible-disclosure@pingidentity.com"},{"url":"https://www.pingidentity.com/en/resources/downloads/pingfederate.html","label":"responsible-disclosure@pingidentity.com"}],"tags":["nvd"],"epss":0.00151,"epssPercentile":0.04675,"ingestedAt":"2026-08-29T18:40:35.882Z","slug":"CVE-2025-32736","body":"## Overview\n\nCross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}