CVE-2023-40545

Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.

CVE-2024-22377

The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.

CVE-2024-22477

A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.