---
title: PingFederate 12.3.7 (July 2026)
description: Security PF-39063
component: pingfederate
version: 13.1
page_id: pingfederate:release_notes:pf_release_notes_1237
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1237.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  resolved-issues: Resolved issues
  log4j-update-to-2-25-4: Log4j update to 2.25.4
  response-code-for-refresh-token-exchange-failure-with-revoked-user-session: Response code for refresh token exchange failure with revoked user session
  extended-property-authentication-selector-dependency-error-warning: Extended Property Authentication Selector dependency error warning
  kerberos-realm-test-failure: Kerberos realm test failure
  jwt-access-token-revocation-fails-with-shared-signing-keys: JWT access token revocation fails with shared signing keys
---

# PingFederate 12.3.7 (July 2026)

## Resolved issues

### Log4j update to 2.25.4

Security PF-39063

We updated `log4j-core`, `log4j-1.2-api`, and `log4j-layout-template-json` to version 2.25.4 to address potential security vulnerabilities.

### Response code for refresh token exchange failure with revoked user session

Fixed PF-38656

We fixed a defect that caused a refresh token for access token exchange to fail with `500 Internal Server Error` instead of `400 Bad Request` when the user's sessions had been revoked.

### Extended Property Authentication Selector dependency error warning

Fixed PF-38901

We fixed a defect that caused PingFederate to continue displaying a dependency error warning for the Extended Property Authentication Selector after the selector instance is deleted.

### Kerberos realm test failure

Fixed PF-39487

We fixed a defect that caused Kerberos realm test connections without explicitly configured KDCs to fail.

### JWT access token revocation fails with shared signing keys

Fixed PF-39526

We fixed a defect that could prevent revocation of a JWT access token when multiple JWT access token managers (ATMs) shared signing keys. PingFederate now identifies the ATM that issued the token and uses it to perform revocation.