PingFederate 13.0.2 (April 2026)
Resolved issues
OGNL code test
Security PF-38742
We improved role-based access control (RBAC) for the administrative expression testing endpoint. Access to expression evaluation is now limited to appropriately-privileged roles, ensuring alignment with intended administrative permissions.
Fixed NPE when updating SP connection
Fixed PF-38508
We fixed a defect that caused a null pointer exception (NPE) error when an SP connection with backchannel authentication inbound authentication type set to No Client Authentication and Require SSL enabled was created or updated using the Admin API.
Log settings not applied on new engine nodes
Fixed PF-38627
We fixed a defect where log settings weren’t applied to newly joined engine nodes.
Response code for refresh token exchange failure with revoked user session
Fixed PF-38656
We fixed a defect that caused a refresh token for access token exchange to fail with 500 Internal Server Error instead of 400 Bad Request when the user’s sessions had been revoked.