PingFederate 12.3.7 (July 2026)
Resolved issues
Log4j update to 2.25.4
Security PF-39063
We updated log4j-core, log4j-1.2-api, and log4j-layout-template-json to version 2.25.4 to address potential security vulnerabilities.
Response code for refresh token exchange failure with revoked user session
Fixed PF-38656
We fixed a defect that caused a refresh token for access token exchange to fail with 500 Internal Server Error instead of 400 Bad Request when the user’s sessions had been revoked.
Extended Property Authentication Selector dependency error warning
Fixed PF-38901
We fixed a defect that caused PingFederate to continue displaying a dependency error warning for the Extended Property Authentication Selector after the selector instance is deleted.
Kerberos realm test failure
Fixed PF-39487
We fixed a defect that caused Kerberos realm test connections without explicitly configured KDCs to fail.
JWT access token revocation fails with shared signing keys
Fixed PF-39526
We fixed a defect that could prevent revocation of a JWT access token when multiple JWT access token managers (ATMs) shared signing keys. PingFederate now identifies the ATM that issued the token and uses it to perform revocation.