---
title: PingFederate 12.3.4 (December 2025)
description: Fixed PF-38028
component: pingfederate
version: 13.1
page_id: pingfederate:release_notes:pf_release_notes_1234
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1234.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  resolved-issues: Resolved issues
  url-validation-for-relaystate: URL validation for RelayState
  ldap-account-lockout: LDAP account lockout
  cluster-management-message-fix: Cluster Management message fix
  adapterid-population-issue: $adapterId population issue
  corrected-null-saasguid: Corrected null SaasGuid
  x-forward-for-ip: X-Forward-For IP
  kerberos-adapter-redirect-url: Kerberos Adapter redirect URL
  jwt-admin-ai-authentication-misconfiguration: JWT Admin AI authentication misconfiguration
  administrative-api-authentication-fix: Administrative API authentication fix
  pi-flow-response_mode-fix: pi.flow response_mode fix
---

# PingFederate 12.3.4 (December 2025)

## Resolved issues

### URL validation for `RelayState`

Fixed PF-38028

We've fixed a defect where PingFederate would reject requests with valid, non-encoded relay state values.

### LDAP account lockout

Fixed PF-38043

We've fixed a defect where PingFederate could incorrectly lock user accounts during an LDAP connectivity failure with Active Directory. This applies to all LDAP datastore types except for Generic LDAP.

### Cluster Management message fix

Fixed PF-38116

We've fixed a defect where **Cluster Management** would present an incorrect success message although the replication failed.

### `$adapterId` population issue

Fixed PF-38146

We've fixed a defect where the `$adapterId` variable wasn't being populated in templates accessed through direct links for the HTML Form Adapter's **Change Password** and **Forgot Password** flows.

### Corrected null `SaasGuid`

Fixed PF-38244

We've fixed a provisioning defect where disabled users weren't provisioned after their account was enabled and the **Provision Disabled Users** setting was set to false.

### `X-Forward-For` IP

Fixed PF-38251

We've fixed a defect where the `X-Forward-For` IP wasn't logged correctly in the `admin.log`.

### Kerberos Adapter redirect URL

Fixed PF-38328

We've fixed a defect where the Kerberos Adapter failed to authenticate when a context path is configured.

### JWT Admin AI authentication misconfiguration

Fixed PF-38336

We've fixed a defect that caused PingFederate to crash or shut down when attempting to access the Admin API with a misconfigured JSON Web Token (JWT) *(tooltip: \<div class="paragraph">
\<p>An IETF standard container format for a JSON object used for the secure exchange of content, such as identity or entitlement information. You can find the industry standard in \<a href="https\://datatracker.ietf.org/doc/html/rfc7519">RFC 7519\</a>.\</p>
\</div>)* authentication setup.

### Administrative API authentication fix

Fixed PF-38393

We've fixed a defect that allowed Basic Authentication to access the Administrative API, even when it was disabled in the `pf.admin.api.authentication` property.

### `pi.flow` `response_mode` fix

Fixed PF-38417

We've fixed a defect where setting `response_mode` to `pi.flow` in Pushed Authorization Requests (PAR) or standard request objects resulted in an `INVALID_REQUEST` error.