Release Notes

Improved PASS-1988

Improved protection for PingCentral frontend JavaScript assets by adding additional obfuscation.

Improved PASS-5930

Added a hover help hint to the Expression dropdown. When an expression name is truncated, hovering over it now displays the full name.

Fixed PASS-6544

Fixed an issue in which SAML attribute-mapping fields imported from metadata were not marked as required. Unfulfilled attributes are now highlighted, making it clear which fields must be completed before the application can be saved.

Fixed PASS-6559

Invalid JSON payloads no longer silently disable the Execute button. Users can now submit the request and receive an appropriate error message.

Improved PASS-6726

Removed the unnecessary OAuth/OIDC radio-button choice when adding an OAuth client as a managed application. PingCentral now determines the client type from the PingFederate API payload, simplifying the setup experience.

Improved PASS-7004

Updated the PingCentral BRASS image to honor the PING_IDENTITY_ACCEPT_EULA=YES environment variable. When enabled, the license agreement screen is skipped during startup and no longer requires manual EULA acceptance.

Improved PASS-7014

Improved PingCentral’s resilience against socket-exhaustion conditions. Server-side timeouts now close idle connections and bound outbound metadata requests, while URL validation reject disallowed targets, helping keep the service responsive under excessive connection or request load.

Improved PASS-7047

Sanitized PingCentral API validation errors to prevent stack traces and internal implementation details from being returned in API responses. Users now receive a concise error message, while detailed diagnostics remain available in the server logs.

Improved PASS-7090

PingCentral only accepts RSA keys for server and client TLS key pairs, and importing an elliptic-curve (EC) key used to cause a server error. Now, users receive a message stating that EC keys are not supported.

Improved PASS-7137

Improved error handling for requests to retrieve a client secret for a SAML application. The /api/v1/applications/clientSecret/{applicationId}/{environmentId} endpoint now returns a validation error with a message stating that client secrets are not applicable to SAML_20_SP applications.

Fixed PASS-7161

Fixed an issue that intermittently prevented PingCentral 3.1 from starting on Java 17 or Java 21.

Improved PASS-7165

Updated the bc-fips security library to version 2.1.2 to address possible vulnerabilities. You can find more information about the CVE-2025-8885 vulnerability on the National Vulnerability Database site.

Improved PASS-7166

Updated the pingcommons-bc-fips dependencies to fixed versions, including bcpkix-fips 2.0.8 and bc-fips 2.1.2. You can find more information about the CVE-2025-8916 vulnerability on the National Vulnerability Database site.

Fixed PASS-7171

Updated the Swagger documentation for POST /api/v1/license/validate to help API users submit license validation requests using the supported request format.

Improved PASS-7173

Updated the pingcommons and commons-lang3 dependencies and upgraded commons-lang3 to version 3.20.0. You can find more information about the CVE-2025-48924 vulnerability on the National Vulnerability Database site.

Improved PASS-7175

Updated all declared json-path dependencies to non-vulnerable versions. You can find more information about the CVE-2023-51074 vulnerability on the National Vulnerability Database site.

Fixed PASS-7177

Updated dependency configuration in the pass-common and pass-jpa-entity modules to exclude transitive spring-boot-starter-logging dependencies, preventing vulnerable Logback components from being included. You can find more information about the CVE-2025-11226 and CVE-2026-1225 vulnerabilities on the National Vulnerability Database site.

Fixed PASS-7205

Applications created from templates created before PingCentral 3.0, or from templates that have not yet been synchronized, could appear without extended properties in PingCentral. Promoting those applications could unintentionally overwrite extended properties that were already configured in PingFederate.

Promotion now preserves existing extended properties when the application has no extended properties configured. The fix applies to both PingFederate clients and SAML connections.

Fixed PASS-7208

After upgrading to version 3.1.0, templates for OIDC and OAuth clients could lose their template association in the admin console, even when the underlying PingFederate OIDC policies were valid. Loading a template could fail with an Unable to retrieve error when older template revisions did not contain expected OIDC policy attributes.

Template retrieval now handles older revision data correctly, allowing OIDC and OAuth client templates to render as expected.

Improved PASS-7209

Previously, application owners had to edit the promotion JSON to configure client-specific values for OAuth and OIDC applications.

PingCentral now lets application owners configure additional client settings during promotion, including the client ID, JWKS URL, and the signing algorithm, providing a more streamlined experience.

New PASS-7213

Previously, administrators had to create multiple trusted expressions or manually update OGNL expressions in PingFederate when applications required small variations.

PingCentral now supports placeholders in OGNL expressions. Administrators can define the portions of an expression that application developers can customize, and input validation can restrict values to approved characters, simplifying application promotion while maintaining control over the expression.

Fixed PASS-7220

Starting with version 3.1.1, OAuth and OIDC application data could be corrupted when an application was edited and saved through the admin console. The Applications page then displayed a white screen, and the application could not be managed normally.

This PostgreSQL-specific issue has been resolved.

Fixed PASS-7221

Version 3.1.1 referenced the Proxima Nova font family, which is not licensed for Ping Identity to use. The UI library was updated to remove this reference.

Fixed PASS-7224

Improved certificate-upload validation to prevent SQL statements and other technical details from appearing in API error responses. Malformed certificates now return a standard validation message, while detailed diagnostics remain available to administrators in server-side logs.

Fixed PASS-7226

Previously, when users added and saved an OAuth or OIDC template or application in PingCentral, the admin console could display a white screen because the CSS file failed to load, even though the template or application was saved successfully.

This issue has been resolved. OAuth and OIDC templates and applications now save and display correctly in the admin console.

Fixed PASS-7227

Fixed an issue in which the PingFederate application number chip displayed N/A when PingFederate was verified. The chip now displays the number of applications and connections that the environment contains.

Fixed PASS-7228

We’ve fixed an issue in which selecting a verified environment from the list of available environments could retrieve data from a different, unverified environment. Promotion operations now load data from the environment selected by the user as expected.