The vulnerability is an open redirect flaw within the PingGateway Fragment Filter that allows an attacker to cause users to be redirected to arbitrary URLs. This flaw can be exploited to facilitate phishing, drive traffic to malicious sites, or bypass authentication flow. The weakness is a classic CWE‑601 type input validation error that undermines user control over navigation.

Affected products are Ping Identity's PingGateway, versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. The issue is fixed in PingGateway 2024.11.2, 2025.11.2, and 2026.3.0 and newer releases.

The CVSS score is 5.1, classifying the vulnerability as a moderate risk. EPSS data is unavailable, and it is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation is currently not known. The likely attack vector is through a web request to a legitimate login or redirect endpoint, with the attacker providing a crafted URL via the Fragment Filter. Because the flaw permits only redirection of users, the impact is primarily phishing or credential harvesting rather than direct compromise, but the ease of exploitation makes it a concern for environments handling sensitive authentication traffic.