CVE-2026-12341

Executive Summary

CVE-2026-12341 is a critical authentication bypass vulnerability affecting all versions of SailPoint IdentityIQ. The flaw allows an unauthenticated, remote attacker to gain unauthorized access to protected APIs and sensitive data due to improper validation of OAuth bearer tokens. With a CVSS score of 8.8 (High), this vulnerability poses a severe risk to identity governance and administration (IGA) systems, which are central to enterprise identity management, access certification, and role management.

The likely attacker profile includes nation-state actors and advanced persistent threat (APT) groups targeting identity infrastructure to establish persistence, escalate privileges, or exfiltrate sensitive user and entitlement data. Ransomware operators may also exploit this to gain initial access to critical systems. The attack vector is network-based, requires no authentication, and has low attack complexity, making it highly accessible to a wide range of threat actors.

Despite an EPSS exploitation probability of 0.0% at the time of publication, the severity of the vulnerability and the critical nature of the affected software demand immediate attention. As of 2026-07-20, no patch is available, and no public proof-of-concept exists. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

CVSS Breakdown & Threat Level

Qualitative Severity: High

The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H decomposes as follows:

• AV:N (Network): The vulnerability is exploitable remotely over the network. An attacker does not require physical or local network access.
• AC:L (Low): No special conditions or race conditions are required. The exploitation does not depend on a specific timing window or complex network state.
• PR:N (None): The attacker does not need any authentication credentials. This is the core of the vulnerability — the OAuth bearer token validation is bypassed entirely.
• UI:N (None): No user interaction is required. The attack is fully automated and does not rely on tricking an administrator or user into performing an action.
• S:U (Unchanged): A successful exploit does not change the scope of the impacted component. The attacker cannot pivot to other security domains beyond the IdentityIQ application.
• C:H/I:H/A:H (High/High/High): Exploitation results in complete compromise of confidentiality, integrity, and availability. An attacker can read all data accessible via APIs, modify or delete that data, and potentially disrupt the IdentityIQ service.

EPSS Interpretation: The EPSS score of 0.0% indicates that as of the publication date, there is no observed exploitation activity in the wild. This is common for zero-day vulnerabilities immediately after disclosure. The score is expected to rise as proof-of-concept code emerges and attackers begin scanning.

Historical Comparison: This vulnerability is technically similar to CVE-2021-44228 (Log4Shell) in that it involves a failure to validate input in a widely-used enterprise application, leading to remote code execution or data access. However, CVE-2026-12341 is specific to OAuth token validation, making it more analogous to CVE-2022-1388 (F5 BIG-IP iControl REST authentication bypass) or CVE-2023-34362 (MOVEit Transfer SQL injection leading to authentication bypass). All share the characteristic of allowing unauthenticated access to critical backend APIs.

Temporal/Environmental Considerations: With no patch available, the temporal score remains at the base score of 8.8. Organizations should consider the environmental score based on the exposure of their IdentityIQ instance. If the application is internet-facing, the risk is critical. If it is isolated on a management network with strict access controls, the effective risk is lower.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability stems from improper validation of OAuth 2.0 bearer tokens within IdentityIQ's API gateway or authentication filter. The developer likely implemented a custom token validation routine that fails to verify the token's signature, issuer, or expiration, or accepts a malformed or null token as valid.

Step-by-Step Exploitation:

1. Reconnaissance: The attacker identifies an exposed IdentityIQ instance, typically on port 8080 (Tomcat default) or 8443 (HTTPS). They discover the API endpoints, often under /identityiq/rest/ or /iiq/oauth2/.
2. Crafting the Request: The attacker constructs an HTTP request to a protected API endpoint (e.g., /identityiq/rest/v3/users). Instead of a valid OAuth bearer token, they send a malformed token, an empty Authorization header, or a token with a known invalid signature.
3. Bypassing Validation: The vulnerable IdentityIQ code receives the request. The token validation logic fails to reject the invalid token. Due to a logic flaw (e.g., a null pointer dereference that defaults to "valid", or a regex that matches an empty string), the request is treated as authenticated.
4. Unauthorized Access: The API gateway processes the request as if it came from a privileged user (e.g., an administrator or the system identity). The attacker can now invoke any API endpoint that relies on this flawed validation.
5. Data Exfiltration / Lateral Movement: The attacker uses the compromised API access to enumerate users, roles, entitlements, and access policies. They can create new accounts, modify existing ones, or extract sensitive identity data.

Attack Surface: The primary attack surface is the IdentityIQ REST API, typically exposed on TCP ports 8080 (HTTP) and 8443 (HTTPS). The vulnerability is exploitable via any HTTP client (curl, Burp Suite, custom scripts). No specific configuration is required beyond having the IdentityIQ application running.

Why Standard Defenses May Fail:

• WAF Rules: A Web Application Firewall (WAF) may not block requests with malformed tokens if it is configured to only inspect for SQL injection or XSS patterns. The request itself is structurally valid HTTP.
• Network Segmentation: If IdentityIQ is exposed to the internet (e.g., for partner or customer self-service), network segmentation alone is insufficient.
• Authentication Logs: The attack may not generate failed login events because the token validation fails silently, and the request is processed as authenticated.

Vulnerable vs. Patched Code Analysis

Note: The following is a hypothetical reconstruction based on the vulnerability description. No actual source code is available.

Vulnerable Pseudocode (Java):

public class OAuthTokenFilter implements Filter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        String authHeader = ((HttpServletRequest) request).getHeader("Authorization");
        String token = extractBearerToken(authHeader);
        // VULNERABLE: No validation of token signature or expiration
        if (token != null && !token.isEmpty()) {
            // Assumes token is valid without verification
            User user = getUserFromToken(token);
            SecurityContext.setCurrentUser(user);
            chain.doFilter(request, response);
        } else {
            // Falls through to unauthenticated processing
            chain.doFilter(request, response); // BUG: Should return 401
        }
    }
}

Patched Pseudocode:

public class OAuthTokenFilter implements Filter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
        String authHeader = ((HttpServletRequest) request).getHeader("Authorization");
        String token = extractBearerToken(authHeader);
        if (token == null || token.isEmpty()) {
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "Missing token");
            return;
        }
        if (!validateTokenSignature(token)) {
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token");
            return;
        }
        if (isTokenExpired(token)) {
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "Token expired");
            return;
        }
        User user = getUserFromToken(token);
        SecurityContext.setCurrentUser(user);
        chain.doFilter(request, response);
    }
}

Patch Analysis: The fix introduces three critical checks: (1) rejecting requests with missing or empty tokens, (2) validating the token's cryptographic signature against a trusted key, and (3) checking token expiration. The patch is sufficient if implemented correctly. A regression risk exists if the token validation logic is too strict and rejects legitimate tokens due to clock skew or key rotation issues.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-20T19:17:18.027
• Estimated Discovery: Unknown. The vulnerability was likely discovered through internal security research or reported by a third-party researcher.
• Disclosure Process: The CVE was published by the CVE Numbering Authority (CNA) for SailPoint. No details on vendor coordination timeline are available.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-20.
• CISA KEV Addition: Not listed as of 2026-07-20.

Threat Intelligence Context

Threat Actor Profile: Identity management systems are high-value targets for APT groups (e.g., APT29, APT41) seeking to compromise identity infrastructure for long-term access. Ransomware groups (e.g., LockBit, BlackCat) may also target IdentityIQ to rapidly enumerate and compromise privileged accounts across an enterprise.

Attack Campaign Context: This vulnerability is not currently associated with any known campaign. However, similar authentication bypass vulnerabilities in IGA platforms have been exploited in the past to facilitate ransomware deployment and data theft.

Geographic Targeting: No specific geographic targeting is known. Any organization using SailPoint IdentityIQ is at risk.

Industry Verticals Most at Risk: Financial services, healthcare, government, and any large enterprise with complex identity governance requirements are most at risk due to the sensitive nature of the data managed by IdentityIQ.

Connection to Similar Vulnerabilities: This CVE is part of a broader trend of authentication bypass vulnerabilities in enterprise identity and access management (IAM) solutions, including CVEs in Okta, Microsoft Active Directory, and ForgeRock.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

1. Environment: Docker container running a vulnerable version of SailPoint IdentityIQ (e.g., version 8.2 or earlier). Use the official SailPoint Docker image if available, or a custom build.
2. Network: Expose the container's port 8080 to the host.
3. Prerequisites: A valid IdentityIQ license (trial or development). Basic understanding of REST APIs.

Exploitation Walkthrough:

1. Identify API Endpoint: Use a tool like curl or Burp Suite to discover API endpoints. A common endpoint is /identityiq/rest/v3/users.

   curl -v http://localhost:8080/identityiq/rest/v3/users
   

   This should return a 401 Unauthorized response.
2. Craft Malformed Token: Send a request with an empty or malformed Authorization header.

   curl -v -H "Authorization: Bearer " http://localhost:8080/identityiq/rest/v3/users
   

   Or:

   curl -v -H "Authorization: Bearer invalidtoken" http://localhost:8080/identityiq/rest/v3/users
   

3. Verify Bypass: If the vulnerability is present, the server will return a 200 OK response with user data instead of a 401.
4. Post-Exploitation: Once access is confirmed, the attacker can:
   • Enumerate all users: GET /identityiq/rest/v3/users
   • Create a new administrator: POST /identityiq/rest/v3/users with JSON payload containing admin role.
   • Extract access policies and certifications.

Expected Output:

[
  {
    "id": "1",
    "name": "admin",
    "displayName": "Administrator",
    "email": "admin@example.com",
    "roles": ["Administrator"]
  },
  ...
]

Blue Team Section

Detection:

• Log Entries: Look for API requests to protected endpoints (e.g., /identityiq/rest/v3/users) that succeed (HTTP 200) without a preceding successful OAuth token exchange. The IdentityIQ audit log may show AUTHENTICATION_SUCCESS events without a corresponding TOKEN_ISSUED event.
• Network Traffic: Monitor for HTTP requests with Authorization: Bearer headers containing unusual patterns (e.g., empty token, base64-encoded strings that are not valid JWTs, or tokens with alg: none in the JWT header).
• Endpoint Behavioral Indicators: Unexpected creation of new users, modification of role assignments, or bulk export of user data.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE-2026-12341_Detection {
    meta:
        description = "Detects exploitation of CVE-2026-12341 in IdentityIQ"
        author = "Valters IT Hub"
        date = "2026-07-20"
        reference = "https://www.valtersit.com/cve/cve-2026-12341"
    strings:
        $bearer_empty = "Authorization: Bearer \r\n" ascii wide nocase
        $bearer_none = "Bearer " ascii wide nocase
        $jwt_none_alg = "alg\":\"none\"" ascii wide nocase
    condition:
        any of ($bearer_empty, $bearer_none) or $jwt_none_alg
}

Sigma Rule (SIEM)

title: CVE-2026-12341 IdentityIQ OAuth Bypass Detection
id: b43b27a7-cec0-4cba-809d-74372f27d22c
status: experimental
description: Detects exploitation attempts targeting CVE-2026-12341 in IdentityIQ
author: Valters IT Hub
date: 2026-07-20
references:
    - https://www.valtersit.com/cve/cve-2026-12341
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/identityiq/rest/*'
        sc-status: 200
        cs(User-Agent): '*'
    filter:
        cs(Authorization): 'Bearer *'
    condition: selection and not filter
falsepositives:
    - Legitimate API calls with valid tokens (should be filtered by the `filter` condition)
level: high

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-12341 IdentityIQ OAuth Bypass Attempt"; flow:to_server; http.header_names; content:"Authorization"; http.header_values; content:"Bearer "; nocase; pcre:"/^Bearer\s*$/"; classtype:attempted-admin; sid:1000001; rev:1;)

Elastic (EQL) Query

sequence by host.hostname
  [network where event.type == "connection" and destination.port in (8080, 8443)]
  [http where event.type == "request" and url.path : "/identityiq/rest/*" and
   not http.request.headers.Authorization : "Bearer *"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/identityiq/rest/*" status=200
| eval has_auth=if(match(authorization, "Bearer .+"), 1, 0)
| where has_auth=0
| stats count by src_ip, uri_path, _time

Wazuh Rule

<group name="identityiq,">
  <rule id="100001" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">AUTHENTICATION_SUCCESS</field>
    <field name="user_name">null</field>
    <description>IdentityIQ: Authentication success with null user - possible CVE-2026-12341 exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

• Patch: No patch is available. Monitor the SailPoint security advisory page for updates.
• Compensating Controls:
  • Network Segmentation: Ensure IdentityIQ is not directly accessible from the internet. Place it behind a VPN or bastion host.
  • WAF Rules: Deploy a WAF rule to block requests to /identityiq/rest/* that do not contain a valid Authorization: Bearer header with a non-empty token.
  • API Gateway: If using an API gateway (e.g., Kong, Apigee), configure it to validate OAuth tokens before forwarding requests to IdentityIQ.
• Authentication Hardening: Disable any API endpoints that are not strictly necessary. Review and restrict API access policies.

Short-term (1-7 days)

• Configuration Hardening: Review IdentityIQ configuration for any settings related to token validation. Ensure that token validation is enabled and configured to use a strong signing key.
• Monitoring Implementation: Deploy the detection rules provided in this report. Enable detailed audit logging for all API access.
• Vulnerability Scanning: Use a vulnerability scanner to identify all instances of IdentityIQ in the environment. Confirm the version and assess exposure.

Long-term

• Architecture Changes: Implement a zero-trust architecture where all API access is mediated by a centralized identity-aware proxy.
• Security Control Improvements: Integrate IdentityIQ with a dedicated OAuth 2.0 authorization server (e.g., Okta, Keycloak) for token issuance and validation.
• Developer Training: Ensure development teams understand secure OAuth implementation practices, including proper token validation.

Validation

To confirm the patch is applied (once available):

1. Check the IdentityIQ version: curl http://localhost:8080/identityiq/rest/about
2. Attempt the exploitation steps from the Red Team section. The server should return a 401 Unauthorized response for all malformed token requests.
3. Review the IdentityIQ audit logs for any AUTHENTICATION_SUCCESS events with a null user.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12341
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-12341
• Vendor advisory: See vendor security page
• OSV: https://osv.dev/vulnerability/CVE-2026-12341 (if applicable)
• Related CWE: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-20 | https://www.valtersit.com/cve/cve-2026-12341