VulnerabilityDeferred

CVE-2026-24069

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application.

MEDIUM 5.4EPSS 0.19%

Does this matter?

Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.

Description

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise (KOP) was affected before 2.8.2509.4.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.19% probability · 9th percentile
CISA KEV: Not listed
Weakness: CWE-863
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://r.sec-consult.com/kiuwanlock
http://seclists.org/fulldisclosure/2026/Apr/5

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.