Vulnerability · Published Jul 20, 2026 · Assigned by SailPoint
CVE-2026-12341SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
High 8.8
In plain English
A high-severity improper authentication in IdentityIQ from SailPoint Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 66.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SailPoint Technologies | IdentityIQ | 8.5 – through 8.5p18.4 – through 8.4p48.3 – through 8.3p5 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H