PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24069 Kiuwan CVE debrief

CVE-2026-24069 is a medium-severity improper authorization vulnerability in Kiuwan SAST that allows disabled user accounts to maintain access via SSO authentication. The flaw stems from inadequate synchronization between local account status and SSO authorization decisions. Kiuwan Cloud and on-premise deployments before version 2.8.2509.4 are affected. The vulnerability was published on April 14, 2026, with the NVD record last modified on May 19, 2026. No known exploitation in ransomware campaigns has been reported.

Vendor
Kiuwan
Product
SAST
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-14
Original CVE updated
2026-05-19
Advisory published
2026-04-14
Advisory updated
2026-05-19

Who should care

Organizations using Kiuwan SAST for code security analysis, particularly those with federated identity and automated user lifecycle management where account disablement is a critical access control mechanism

Technical summary

Kiuwan SAST fails to properly validate account status during SSO authentication, allowing locally disabled accounts to retain or regain application access. The authorization check does not adequately correlate SSO identity assertions with local account state, resulting in a logic flaw where disablement actions are not enforced at the authentication boundary. This affects both cloud-hosted and on-premise deployments, with on-premise versions requiring update to 2.8.2509.4 or later.

Defensive priority

medium

Recommended defensive actions

  • Review Kiuwan SAST deployment type (Cloud vs. on-premise) and verify version against 2.8.2509.4 for on-premise installations
  • Audit currently disabled accounts with SSO mappings to identify potential unauthorized access during exposure window
  • Verify SSO integration configuration enforces real-time account status checks rather than cached or periodic synchronization
  • Implement compensating monitoring for authentication events from accounts marked disabled in local user stores
  • Coordinate with identity provider administrators to ensure account disablement propagates through SAML/OIDC assertions where applicable

Evidence notes

The vulnerability description indicates improper authorization (CWE-863) for SSO-mapped accounts where local disablement does not invalidate active SSO sessions or prevent re-authentication. Affected versions are explicitly bounded: Kiuwan Cloud (fixed) and Kiuwan SAST on-premise versions prior to 2.8.2509.4. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector with low privileges required, yielding medium severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24069 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24069

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24069 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24069

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://r.sec-consult.com/kiuwanlock

    551230f0-3615-47bd-b7cc-93e92e730bbf

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.