CVE-2026-12341
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
All versions of IdentityIQ are vulnerable to unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. An unauthenticated attacker can exploit this.
Risk Assessment
An unauthenticated attacker could access and manipulate sensitive identity data, compromising the entire IAM system.
Recommendation
Apply the vendor patch and strengthen OAuth token validation.
Other vulnerabilities in IdentityIQ
See all- CVE-2026-12342Critical
A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
- CVE-2026-5712High
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
Original NVD description (English source)
This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS