9.8

CVE-2026-12341

SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated attacker
unauthorized access to protected APIs and data due to improper validation of
OAuth bearer tokens.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sailpoint ≫ Identityiq Version < 8.3
Sailpoint ≫ Identityiq Version8.3 Update-
Sailpoint ≫ Identityiq Version8.3 Updatepatch1
Sailpoint ≫ Identityiq Version8.3 Updatepatch2
Sailpoint ≫ Identityiq Version8.3 Updatepatch3
Sailpoint ≫ Identityiq Version8.3 Updatepatch4
Sailpoint ≫ Identityiq Version8.3 Updatepatch5
Sailpoint ≫ Identityiq Version8.4 Update-
Sailpoint ≫ Identityiq Version8.4 Updatepatch1
Sailpoint ≫ Identityiq Version8.4 Updatepatch2
Sailpoint ≫ Identityiq Version8.4 Updatepatch3
Sailpoint ≫ Identityiq Version8.4 Updatepatch4
Sailpoint ≫ Identityiq Version8.5 Update-
Sailpoint ≫ Identityiq Version8.5 Updatepatch1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.122
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
psirt@sailpoint.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://www.sailpoint.com/security-advisories/
Vendor Advisory