Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260414-0",
          "vendor": "Kiuwan",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260414-0 \u003e\n=======================================================================\n              title: Improper Enforcement of Locked Accounts in WebUI (SSO)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Kiuwan SAST on-premise (KOP) \u0026 cloud/SaaS\n\u00a0vulnerable version: \u003c2.8.2509.4\n\u00a0 \u00a0 \u00a0 fixed version: 2.8.2509.4\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-24069\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.kiuwan.com/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2025-03-31\n                 by: Bernhard Gr\u00fcndling (Office Vienna)\n                     Fabian W\u00fcrfl (Office Vienna)\n                     Johannes Greil (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Thorough code inspection is essential for designing secure software products.\nWhile your development team may not have time to comb through every line of code,\nKiuwan does. For 20 years, it has been the choice of developers to scan code\nautomatically and remediate defects according to security standards like OWASP,\nCWE, SANS, and CERT.\n\nStatic application security testing (SAST) scans for security flaws in the source\ncode without running the program. It is a white-box testing method that is the\ncounterpart to dynamic application software testing (DAST), which tests web applications\nfor run-time vulnerabilities. [...]\"\n\nSource:https://www.kiuwan.com/code-security-sast/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)\nKiuwan offers the possibility to enable single sign-on (SSO) for authentication,\ne.g. through Microsoft ADFS or Azure to authenticate against an active directory.\nIt needs to map the AD user accounts with locally configured accounts for\nauthorization purposes, e.g. to configure the roles and access to applications.\nSSO users have the local logon disabled and there is no password set, authentication\nonly works via SSO then.\n\nIt was found out that the user is still able to login at the Kiuwan WebUI via SSO,\neven if the Kiuwan mapped account has been disabled in the user settings by an admin.\nThe login does not work in the scanner agent (KLA - Kiuwan Local Analyzer) though.\nThere the authorization check seems to be verifying the validity of the account first\nand throws the error message \"Failed to authenticate using Single sign-on\".\n\n\nProof of concept:\n-----------------\n1) Improper Enforcement of Locked Accounts in WebUI (SSO) (CVE-2026-24069)\nNo specific PoC is necessary. An SSO login is possible even after disabling\nthe Kiuwan mapped user account in the Kiuwan user admin settings.\nSteps to reproduce:\na) Disable user in Kiuwan user settings\nb) Authenticate via SSO, e.g. through Microsoft ADFS\nc) Login is possible in the Kiuwan WebUI\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 2.8.2412.0\n\n\nVendor contact timeline:\n------------------------\n2025-04-02: Contacting vendor through official Kiuwan ticket system\n            (https://kiuwan.zendesk.com)\n            Kiuwan support responds that they will take a look into\n            our submission. Support sends us a few details regarding\n            SSO authentication.\n2025-04-03: Informing the vendor that we know how SSO auth in Kiuwan\n            works and our vulnerability exploits the improper enforcement\n            of locked accounts.\n2025-04-15: Vendor informs us that the issue has been escalated to R\u0026D.\n2025-07-29: Vendor has resolved the issue in the latest Kiuwan Cloud release.\n2025-07-29: Asking the vendor regarding the fix for Kiuwan On-Premise.\n            Vendor responds that it is currently being tested for KOP and\n            they will inform us.\n2025-11-03: Asking for a status update as we were not informed yet.\n2025-11-10: Support team responds that KOP release is expected within the\n            next couple of weeks.\n2025-11-24: Issue has been resolved in the latest KOP release.\n2025-11-28: Informing vendor that we cannot upgrade/verify the KOP release yet,\n            scheduled for 2026.\n2026-04-14: Public release of advisory.\n\n\nSolution:\n---------\nThe security issue has been fixed by the vendor on 29th July 2025 for the\nKiuwan Cloud solution.\n\nThe vendor provides a patch for the Kiuwan On-Premises version 2.8.2509.4\nwhich can be downloaded from the vendor\u0027s installation page:\nhttps://support.kiuwan.com/hc/en-us/articles/36356787260433-Kiuwan-On-Premises-Distributed-Installation-Guide\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Bernhard Gr\u00fcndling, Johannes Greil, Fabian W\u00fcrfl / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:49:25Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/5"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://kiuwan.zendesk.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.kiuwan.com/hc/en-us/articles/36356787260433-Kiuwan-On-Premises-Distributed-Installation-Guide"
        },
        {
          "url": "https://www.kiuwan.com/"
        },
        {
          "url": "https://www.kiuwan.com/code-security-sast/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/5"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260414-0 :: Improper Enforcement of Locked Accounts in WebUI (SSO) in Kiuwan SAST on-premise (KOP) \u0026 cloud/SaaS",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-24069",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0254",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/5",
            "automated": true,
            "contentSha256": "5bf6b21d2b94d49aa57521ba89c0abb15924a55d944633bb6283d7b3ce30451d",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/5",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-14T10:31:18Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0254"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-09T13:49:25Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0254"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}