Management summary
Kiuwan SAST did not properly enforce the configuration of locked accounts and allowed a login to the WebUI through SSO authentication, even though the locally mapped Kiuwan account was disabled.
Vendor description
"Thorough code inspection is essential for designing secure software products. While your development team may not have time to comb through every line of code, Kiuwan does. For 20 years, it has been the choice of developers to scan code automatically and remediate defects according to security standards like OWASP,
CWE, SANS, and CERT.
Static application security testing (SAST) scans for security flaws in the source code without running the program. It is a white-box testing method that is the counterpart to dynamic application software testing (DAST), which tests web applications for run-time vulnerabilities. [...]
Source: https://www.kiuwan.com/code-security-sast/
Business recommendation
The vendor provides a patch which should be installed immediately.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)
Kiuwan offers the possibility to enable single sign-on (SSO) for authentication, e.g. through Microsoft ADFS or Azure to authenticate against an active directory. It needs to map the AD user accounts with locally configured accounts for authorization purposes, e.g. to configure the roles and access to applications. SSO users have the local logon disabled and there is no password set, authentication only works via SSO then.
It was found out that the user is still able to login at the Kiuwan WebUI via SSO, even if the Kiuwan mapped account has been disabled in the user settings by an admin. The login does not work in the scanner agent (KLA - Kiuwan Local Analyzer) though. There the authorization check seems to be verifying the validity of the account first and throws the error message "Failed to authenticate using Single sign-on".
Proof of concept
1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)
No specific PoC is necessary. An SSO login is possible even after disabling the Kiuwan mapped user account in the Kiuwan user admin settings.
Steps to reproduce:
- Disable user in Kiuwan user settings
- Authenticate via SSO, e.g. through Microsoft ADFS
- Login is possible in the Kiuwan WebUI
Vulnerable / tested versions
The following version has been tested which was the latest version available at the time of the test:
- 2.8.2412.0