CVE-2026-12341

HIGH

SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

Title source: cna

Description

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

References (1)

Core 1

Core References

https://www.sailpoint.com/security-advisories/

Scores

CVSS v3 8.8

EPSS 0.0022

EPSS Percentile 12.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-287

Status published

Products (7)

sailpoint/identityiq 8.3 (6 CPE variants)

sailpoint/identityiq 8.4 (5 CPE variants)

sailpoint/identityiq 8.5 (2 CPE variants)

sailpoint/identityiq < 8.3

SailPoint Technologies/IdentityIQ 8.3 - 8.3p5

SailPoint Technologies/IdentityIQ 8.4 - 8.4p4

SailPoint Technologies/IdentityIQ 8.5 - 8.5p1

Published Jul 20, 2026

Tracked Since Jul 21, 2026