CVE-2023-40545 is a high severity authentication bypass in PingFederate 11.3. It affects OAuth2 clients that authenticate with client_secret_jwt and can be triggered by specially crafted requests. NVD scores it 8.8. Ping Identity published advisory SECADV040; read it for the fixed release and upgrade.
What's affected
The NVD description says the flaw affects PingFederate 11.3 versions when an OAuth2 client uses client_secret_jwt as its authentication method. The record's product list shows PingFederate 11.3.0. The weakness is CWE-306, missing authentication for a critical function.
The record references three Ping pages: the security advisory SECADV040 on the Ping support site, a PingFederate 11.3 documentation page, and the previous releases download page. When this post was prepared, the support article and the documentation page did not return readable content, so I could not confirm the exact fixed version from them. Do not rely on a number from a third party. Open SECADV040 and read the table of affected and fixed versions.
The vector is network, low complexity, low privileges required, no user interaction, with high impact on confidentiality, integrity and availability. CISA's Known Exploited Vulnerabilities catalog does not list it, and nothing I read says it is exploited in the wild.
How to check if you're exposed
Start with the version your server reports. Your PingFederate administrators can read the version from the administrative console or the installation, and Ping's documentation describes where.
Then find out whether you are in the exposed configuration. The description limits the issue to OAuth2 clients that use client_secret_jwt for client authentication. In the administration console, review each OAuth client's configured authentication method. A client set to any other method is outside the description, but confirm that against the advisory, since this post could not read it in full.
What to do now
- Record your PingFederate version and whether any OAuth clients use client_secret_jwt.
- Open Ping's advisory SECADV040 and find the fixed release for the 11.3 line.
- Schedule the upgrade, starting with internet-facing servers and those that serve clients with the vulnerable method.
- Until you can upgrade, ask Ping's advisory or support whether a different client authentication method is a safe interim choice for affected clients.
- After patching, review token endpoint logs for unusual client activity from the period you were exposed.
Why it matters
Authentication bypass bugs let a caller prove an identity it does not hold. In OAuth, client authentication tells the authorization server which application is asking for tokens. If that check can be skipped for a method such as client_secret_jwt, a request may be accepted as an authenticated client when it should be refused.
The scoring reflects what an identity provider protects. The vector requires a low privilege level, yet the impact is rated high across all three areas, because tokens issued by a federation server feed many other systems. Identity infrastructure is a high-value target, so a patch window here is worth prioritising.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect every PingFederate install?
The description limits it to version 11.3 installs where an OAuth2 client uses client_secret_jwt for authentication. Check the advisory for the full list.
What weakness class is this?
It is CWE-306, missing authentication for a critical function, as listed in the record.
Sources
- Ping Identity advisory SECADV040 (page did not return readable content when fetched, so confirm versions there)
- PingFederate 11.3 documentation page referenced by NVD
- Safeguard Gold entry for CVE-2023-40545
Last reviewed: 19 October 2026.
