🎯Basically, locked accounts can still log in, which is a security problem.
What Happened
A security advisory from SEC Consult Vulnerability Lab revealed a vulnerability in Kiuwan SAST, specifically related to the improper enforcement of locked accounts in the Web User Interface (WebUI) when using Single Sign-On (SSO). This flaw allows users to log in even if their accounts have been disabled by an administrator.
The Flaw
The vulnerability, identified as CVE-2026-24069, affects versions of Kiuwan SAST prior to 2.8.2509.4. The issue arises because the SSO authentication process does not adequately check the status of the user account mapped from Active Directory (AD). While the Kiuwan Local Analyzer (KLA) correctly denies access for locked accounts, the WebUI does not enforce this restriction, allowing unauthorized access.
What's at Risk
Organizations using Kiuwan SAST for code security may unknowingly expose their systems to unauthorized access. This can lead to potential data breaches and exploitation of sensitive information, particularly if users with elevated privileges are able to log in despite their accounts being disabled.
Patch Status
The vendor has released a patch for the vulnerability, which should be applied immediately. The fixed version is 2.8.2509.4. Users are encouraged to update their systems to mitigate this risk. The advisory also recommends conducting a thorough security review to identify any other potential vulnerabilities.
Immediate Actions
- Update Kiuwan SAST to version 2.8.2509.4 or later.
- Review user account settings to ensure that disabled accounts cannot log in via SSO.
- Monitor access logs for any unauthorized login attempts.
Conclusion
This vulnerability highlights the importance of rigorous account management and authentication checks in software solutions. Organizations must remain vigilant and ensure that all security patches are applied promptly to protect against potential threats.
🔒 Pro insight: The flaw underscores the need for robust account management practices in SSO implementations, especially in security-focused applications.
