Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise (KOP) was affected before 2.8.2509.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-14 | 1 | Disclosure1 |
| 2026-04-19 | 1 | General1 |
CVE-2026-24069 Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud wa… https://www.cve.org/CVERecord?id=CVE-2026-24069
Post summary
The text reports that Kiuwan’s SAST platform is vulnerable to SSO authorization bypass for disabled mapped accounts, enabling unauthorized access.
『An SSO login is possible even after disabling the Kiuwan mapped user account in the Kiuwan user admin settings.』 CVE-2026-24069 Improper Enforcement of Locked Accounts in WebUI (SSO) in Kiuwan SAST on-premise (KOP) & cloud/SaaS - SEC Consult https://sec-consult.com/vulnerability-lab/advisory/improper-enforcement-of-locked-accounts-in-webui-sso-in-kiuwan-sast-on-premise-kop-cloud-saas/
Post summary
The advisory discloses that Kiuwan’s SSO system fails to enforce account lockouts, allowing logins after disabling a mapped user, but no PoC, exploit, patch, or active exploitation claim is included.