CVE-2026-59151
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in Prowler before 5.30.3 allows an attacker to take over accounts in another tenant by manipulating the email address in a SAMLResponse. The system trusted the email domain from the SAMLResponse when selecting the tenant, instead of binding the token to the validated SAML configuration.
Risk Assessment
An attacker with a controlled SAML IdP can obtain a JWT for a different tenant, leading to cross-tenant account takeover and unauthorized access to cloud resources.
Recommendation
Immediately upgrade Prowler to version 5.30.3 or later. After upgrading, review the SAML configuration and ensure tokens are issued only for approved domains.
Original NVD description (English source)
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.