Kiuwan SAST improperly authorizes single sign-on (SSO) logins for user accounts that have been locally disabled but are mapped for SSO. This flaw allows disabled users to bypass local account restrictions and maintain access to the application. The vulnerability affects Kiuwan Cloud and on-premise installations before version 2.8.2509.4. No CVSS score or official remediation level is provided, and no patch links are available in the provided data.

Users who have been disabled locally can still access the Kiuwan SAST application through SSO, potentially allowing unauthorized access to sensitive application functions or data. This undermines access control policies and could lead to unauthorized use of the system. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Kiuwan's advisories for updates. Until a fix is available, consider restricting or disabling SSO mappings for disabled accounts as a temporary measure if possible.