CVE-2026-12341 is a high-severity authentication flaw (CVSS 8.8) in SailPoint IdentityIQ. It affects all versions and comes from improper validation of OAuth bearer tokens, which can give an unauthenticated attacker access to protected APIs and data. Confirm the fix with SailPoint and limit who can reach the APIs.
What's affected
From the CVE record:
- Product: SailPoint IdentityIQ. The record says the flaw impacts all versions.
- Cause: improper validation of OAuth bearer tokens.
- Effect: an unauthenticated attacker gains unauthorized access to protected APIs and data.
- Weakness class: CWE-287 (improper authentication).
- Severity: CVSS 8.8. The vector shows network access, low complexity, no privileges, and required user interaction (UI:R), with High impact on all three security properties.
- Fixed version: the record does not name one. When we reviewed SailPoint's security advisories page, it did not list this CVE. Ask SailPoint support for the fix or workaround before you rely on any version being safe.
How to check if you're exposed
IdentityIQ is installed software, so the check is about your deployment and exposure.
- List every IdentityIQ environment: production, test and disaster recovery copies. The record says all versions are affected, so version number will not clear you.
- Find out whether the IdentityIQ APIs are reachable from the internet or from broad internal networks, and who or what calls them.
- Check whether OAuth bearer tokens are in use for those APIs, and which authorization server issues them.
- Review API access logs for calls that cannot be tied to a known integration or user, especially calls that succeeded without an expected token source.
- Check the SailPoint security advisories page and your support portal for a notice about this CVE.
What to do now
- Open a case with SailPoint and ask for the fix or the recommended mitigation for CVE-2026-12341. The public advisories page did not list it when we reviewed it.
- Restrict network access to the IdentityIQ APIs to the systems that call them. An identity governance tool should not be broadly reachable.
- Review API logs for the period since publication on 20 July 2026, and for earlier if you keep them.
- Review accounts, entitlements and access request changes made through the API for anything you cannot explain.
- If you find signs of abuse, treat the data the APIs expose as accessed, and rotate service credentials that IdentityIQ holds for connected systems.
Why it matters
Identity governance software sits close to the keys. It holds who has access to what, and often holds credentials for the connected systems it manages. A flaw that lets an attacker pass an OAuth token check puts that data and those APIs in reach.
A bearer token works like a ticket: whoever shows it is let in, so the server has to check it carefully. Careful checking means validating who issued the token, that it has not expired, that it was meant for this service and that its signature or its introspection result is genuine. The record says the validation in IdentityIQ was improper, but it does not say which of those checks fell short, and we do not guess.
The vector marks user interaction as required, which lowers the score slightly from a fully automatic attack. It still gives High impact on confidentiality, integrity and availability. The CVE is not in the CISA Known Exploited Vulnerabilities catalog. Because the public information is thin, the best protection until you hear from SailPoint is to shrink the set of systems that can reach the APIs.
Quick check
Which IdentityIQ version fixes this?
The record names none and says all versions are affected. Ask SailPoint support. The vendor advisories page did not list the CVE when we looked.
Does a lower version number protect us?
No. The record says the flaw impacts all versions.
Sources
- Gold entry and CVE record: CVE-2026-12341.
- SailPoint security advisories page, reviewed for this CVE and not listing it at review time.
Last reviewed: 19 October 2026.
