---
title: PingFederate 13.0.2 (April 2026)
description: Security PF-38742
component: pingfederate
version: 13.1
page_id: pingfederate:release_notes:pf_release_notes_1302
canonical_url: https://docs.pingidentity.com/pingfederate/13.1/release_notes/pf_release_notes_1302.html
llms_txt: https://docs.pingidentity.com/pingfederate/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
section_ids:
  resolved-issues: Resolved issues
  ognl-code-test: OGNL code test
  jackson-core-update: jackson-core update
  fixed-npe-when-updating-sp-connection: Fixed NPE when updating SP connection
  log-settings-not-applied-on-new-engine-nodes: Log settings not applied on new engine nodes
  response-code-for-refresh-token-exchange-failure-with-revoked-user-session: Response code for refresh token exchange failure with revoked user session
  ciba-token-request-fails-with-ldap-persistent-grant-storage: CIBA token request fails with LDAP persistent grant storage
  admin-api-oauth-authentication-failure: Admin API OAuth authentication failure
---

# PingFederate 13.0.2 (April 2026)

## Resolved issues

### OGNL code test

Security PF-38742

We improved role-based access control (RBAC) for the administrative expression testing endpoint. Access to expression evaluation is now limited to appropriately-privileged roles, ensuring alignment with intended administrative permissions.

### `jackson-core` update

Security PF-38830

We've upgraded `jackson-core` to version 2.21.1 to continue alignment with maintained upstream dependencies and remove potential security vulnerabilities.

### Fixed NPE when updating SP connection

Fixed PF-38508

We fixed a defect that caused a null pointer exception (NPE) error when an SP connection with backchannel authentication inbound authentication type set to **No Client Authentication** and **Require SSL** enabled was created or updated using the Admin API.

### Log settings not applied on new engine nodes

Fixed PF-38627

We fixed a defect where log settings weren't applied to newly joined engine nodes.

### Response code for refresh token exchange failure with revoked user session

Fixed PF-38656

We fixed a defect that caused a refresh token for access token exchange to fail with `500 Internal Server Error` instead of `400 Bad Request` when the user's sessions had been revoked.

### CIBA token request fails with LDAP persistent grant storage

Fixed PF-38706

We fixed a defect that caused CIBA token requests to fail when persistent grants are stored in an LDAP directory like PingDirectory.

### Admin API OAuth authentication failure

Fixed PF-38722

We fixed a defect that caused OAuth and JWT authentication through the Admin API to fail when the `role attribute name` parameter used the scope claim containing space-delimited values.