CVE-2026-12341: IdentityIQ Auth Bypass Vulnerability

CVE-2026-12341 Overview

CVE-2026-12341 is an authentication bypass vulnerability affecting all versions of SailPoint IdentityIQ. The flaw stems from improper validation of OAuth bearer tokens, allowing an unauthenticated attacker to gain unauthorized access to protected APIs and sensitive identity data. IdentityIQ is a widely deployed identity governance platform that manages access to enterprise applications, making the exposed APIs a high-value target. The vulnerability is categorized under [CWE-287] Improper Authentication and requires user interaction over a network vector to complete exploitation.

Critical Impact
An unauthenticated attacker can bypass OAuth token validation to access protected IdentityIQ APIs, exposing confidentiality, integrity, and availability of governed identity data.

Affected Products

SailPoint IdentityIQ (all versions)
Deployments exposing IdentityIQ REST APIs to network-accessible clients
Environments relying on OAuth bearer tokens for IdentityIQ API authentication

Discovery Timeline

2026-07-20 - CVE-2026-12341 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-12341

Vulnerability Analysis

The vulnerability resides in the OAuth bearer token validation logic used by IdentityIQ to authenticate API requests. The platform fails to fully verify tokens presented by clients, allowing crafted or otherwise invalid tokens to be accepted as legitimate. Successful exploitation grants an attacker the ability to interact with protected API endpoints as if they were an authenticated principal.

Because IdentityIQ governs privileged identity operations such as access reviews, role assignment, and provisioning, unauthorized API access carries direct impact on the confidentiality and integrity of enterprise identity data. The CWE-287 classification reflects a fundamental breakdown in the authentication mechanism rather than a peripheral misconfiguration.

Root Cause

The root cause is improper validation of OAuth bearer tokens presented to IdentityIQ APIs. The token verification path does not enforce the full set of checks required to establish token authenticity, integrity, and authorization scope. This permits requests carrying malformed or unauthorized tokens to reach protected resources.

Attack Vector

Exploitation occurs over the network against exposed IdentityIQ API endpoints. An attacker sends API requests with a manipulated OAuth bearer token in the Authorization header. The user interaction requirement noted in the advisory suggests exploitation may involve inducing a legitimate user to trigger a request flow that produces or forwards an attacker-controlled token. Once accepted, the attacker interacts with protected APIs using the effective privileges tied to the accepted token context.

No verified public proof-of-concept code is available. Refer to the SailPoint Security Advisories for authoritative technical details.

Detection Methods for CVE-2026-12341

Indicators of Compromise

Unexpected successful authentication events against IdentityIQ REST API endpoints from unfamiliar source addresses or user agents.
API access patterns that bypass normal interactive login flows, such as bearer-token requests without corresponding OAuth authorization code exchanges.
Bulk enumeration of identities, roles, or entitlements through IdentityIQ APIs outside of scheduled integration windows.

Detection Strategies

Inspect IdentityIQ application logs for API requests where the presented bearer token lacks a matching issuance record in the OAuth token store.
Correlate API gateway or reverse proxy logs against IdentityIQ audit events to identify authenticated API calls without prior token issuance.
Alert on API responses returning sensitive identity objects to sessions that never completed a full OAuth authorization flow.

Monitoring Recommendations

Forward IdentityIQ audit logs, web server access logs, and OAuth token issuance events into a centralized analytics platform for correlation.
Baseline normal API consumers by source IP, client ID, and endpoint, then alert on deviations such as new clients accessing /identityiq/rest/ paths.
Monitor for privilege-sensitive API operations, including role modifications and entitlement grants, initiated by non-interactive sessions.

How to Mitigate CVE-2026-12341

Immediate Actions Required

Review the SailPoint Security Advisories portal for the current patch or hotfix guidance applicable to your IdentityIQ version.
Restrict network exposure of IdentityIQ API endpoints to trusted management networks and known integration systems until patched.
Rotate OAuth client secrets and revoke existing bearer tokens to invalidate any tokens that may have been misused.

Patch Information

SailPoint has published guidance through its security advisories portal. Administrators should consult the SailPoint Security Advisories page for version-specific patches, hotfixes, and upgrade instructions covering all affected IdentityIQ releases.

Workarounds

Place IdentityIQ behind an authenticating reverse proxy or API gateway that performs independent OAuth token introspection before forwarding requests.
Disable or tightly scope OAuth API clients that are not actively required for integrations.
Enforce network-level allow-lists restricting API consumers to known, authenticated systems.

bash

# Example: restrict IdentityIQ API paths at the reverse proxy until patched
location /identityiq/rest/ {
    allow 10.0.0.0/8;      # trusted integration subnet
    deny  all;
    proxy_pass http://identityiq-backend;
}