CVE-2026-12341

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - psirt@sailpoint.com

Published

2026-07-20

Last modified

2026-10-24

Weaknesses

CWE-287

Affected products

• Identityiq (Sailpoint)
• Identityiq (Sailpoint Technologies)

References

• https://www.sailpoint.com/security-advisories/