PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24069 Kiuwan CVE debrief

CVE-2026-24069 is a medium-severity improper authorization vulnerability in Kiuwan SAST that allows disabled user accounts to maintain access via SSO authentication. The flaw stems from inadequate synchronization between local account status and SSO authorization decisions. Kiuwan Cloud and on-premise deployments before version 2.8.2509.4 are affected. The vulnerability was published on April 14, 2026, with the NVD record last modified on May 19, 2026. No known exploitation in ransomware campaigns has been reported.

Vendor
Kiuwan
Product
SAST
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-14
Original CVE updated
2026-05-19
Advisory published
2026-04-14
Advisory updated
2026-05-19

Who should care

Organizations using Kiuwan SAST for code security analysis, particularly those with federated identity and automated user lifecycle management where account disablement is a critical access control mechanism

Technical summary

Kiuwan SAST fails to properly validate account status during SSO authentication, allowing locally disabled accounts to retain or regain application access. The authorization check does not adequately correlate SSO identity assertions with local account state, resulting in a logic flaw where disablement actions are not enforced at the authentication boundary. This affects both cloud-hosted and on-premise deployments, with on-premise versions requiring update to 2.8.2509.4 or later.

Defensive priority

medium

Recommended defensive actions

  • Review Kiuwan SAST deployment type (Cloud vs. on-premise) and verify version against 2.8.2509.4 for on-premise installations
  • Audit currently disabled accounts with SSO mappings to identify potential unauthorized access during exposure window
  • Verify SSO integration configuration enforces real-time account status checks rather than cached or periodic synchronization
  • Implement compensating monitoring for authentication events from accounts marked disabled in local user stores
  • Coordinate with identity provider administrators to ensure account disablement propagates through SAML/OIDC assertions where applicable

Evidence notes

The vulnerability description indicates improper authorization (CWE-863) for SSO-mapped accounts where local disablement does not invalidate active SSO sessions or prevent re-authentication. Affected versions are explicitly bounded: Kiuwan Cloud (fixed) and Kiuwan SAST on-premise versions prior to 2.8.2509.4. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector with low privileges required, yielding medium severity.

Official resources

The vulnerability was disclosed via coordinated disclosure through SEC Consult, with public disclosure occurring on April 14, 2026. The vendor has released patched versions for affected on-premise deployments.