Executive brief
Kiuwan SAST, a tool used by developers to scan source code for security flaws, contains a vulnerability where users with disabled accounts can still log in via Single Sign-On (SSO). This means that an employee or contractor whose access was intended to be revoked could still access the web interface and view sensitive code analysis data. Organizations using SSO for authentication are at risk if they rely on local account disabling to manage access.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Kiuwan SAST's WebUI when configured with Single Sign-On (SSO) providers like Microsoft ADFS or Azure. While the application correctly maps external identities to local accounts for role-based access control, it fails to verify the 'disabled' status of the local account during the SSO authentication flow. An attacker with valid SSO credentials can successfully authenticate and access the WebUI even if their corresponding local Kiuwan account has been disabled by an administrator. This issue specifically affects the WebUI; the Kiuwan Local Analyzer (KLA) agent is not affected as it performs a proper validity check. The vulnerability has been patched in Kiuwan Cloud and Kiuwan On-Premise version 2.8.2509.4.
Affected products
- Kiuwan Kiuwan SAST Cloud/SaaS
- Kiuwan Kiuwan SAST on-premise (KOP) < 2.8.2509.4
Timeline
- 2025-03-31: other: Vulnerability discovered by SEC Consult
- 2025-04-02: other: Vendor contacted
- 2025-07-29: patched: Fixed in Kiuwan Cloud release
- 2025-11-24: patched: Fixed in Kiuwan On-Premise (KOP) release
- 2026-04-14: disclosed: Public advisory released