This vulnerability affects all listed versions of SailPoint IdentityIQ and arises from improper validation of OAuth bearer tokens, enabling unauthenticated attackers to access protected APIs and sensitive data without authorization. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation responsibility lies with the user.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and access protected APIs and data, potentially leading to full compromise of confidentiality, integrity, and availability of the IdentityIQ system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to IdentityIQ APIs and monitor for suspicious activity related to OAuth token usage. Follow vendor updates closely for official patches or mitigations.