Kiuwan WebUI SSO Improper Enforcement of Locked Accounts (CVE-2026-24069)

Vulnerability Summary: Improper Enforcement of Locked Accounts in Kiuwan WebUI (SSO) Vulnerability Overview Vulnerability Name: Improper Enforcement of Locked Accounts in WebUI (SSO) CVE ID: CVE-2026-24069 Description: Kiuwan supports single sign-on (SSO) via Microsoft ADFS, Azure, etc. When configuring roles and access permissions, the system maps AD user accounts to local accounts. Core Issue: When an administrator disables a user account in Kiuwan’s user settings (e.g., disabling local login and setting no password, allowing only SSO login), the user can still successfully log in to the Kiuwan WebUI via SSO. The system fails to properly verify the disabled status of the account, resulting in ineffective authorization checks. Impact Scope Affected Version: 2.8.2412.0 (latest version at time of testing) Affected Component: Kiuwan WebUI (SSO) Impact Consequence: Disabled accounts by administrators can still access the system, posing a risk of unauthorized access. Remediation Vendor Response: Kiuwan Cloud: Fixed on July 29, 2025, via the latest version. Kiuwan On-Premises: Patch version 2.8.2509.4 is available. Patch Download**: The patch can be downloaded from the vendor’s installation page: Proof of Concept (PoC) No specific code block is provided on the page, but reproduction steps are given: 1. Disable the user in Kiuwan’s user settings. 2. Authenticate via SSO (e.g., Microsoft ADFS). 3. Successfully log in to the Kiuwan WebUI.

Goal Reached Thanks to every supporter — we hit 100%!

Kiuwan WebUI SSO Improper Enforcement of Locked Accounts (CVE-2026-24069)