CVE-2026-59151: CWE-287: Improper Authentication in prowler-cloud prowler
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.
AI Analysis
Technical Summary
Prowler's SAML authentication flow prior to version 5.30.3 improperly trusts the email domain asserted in the SAMLResponse to determine tenant assignment. The ACS finish logic recalculates the tenant from user.email rather than binding token issuance to the validated SAML configuration. An attacker with control over a SAML Identity Provider (IdP) can complete a valid SAML flow for an attacker-controlled domain while asserting an email from another tenant's domain. This causes issuance of a SAML token and tenant-scoped JWT for the wrong tenant, enabling cross-tenant account takeover. The vulnerability is addressed in prowler 5.30.3.
Potential Impact
An authenticated attacker controlling a SAML IdP can exploit this vulnerability to obtain authentication tokens scoped to a tenant they do not belong to, resulting in cross-tenant account takeover. This compromises confidentiality and integrity of tenant data. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade prowler to version 5.30.3 or later, where this improper authentication vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor stating the fix is in 5.30.3.
CVE-2026-59151: CWE-287: Improper Authentication in prowler-cloud prowler
Description
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.
CVSS v3.1
Score 9.6critical
Affected software
pkg:github/prowler-cloud/prowlerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Prowler's SAML authentication flow prior to version 5.30.3 improperly trusts the email domain asserted in the SAMLResponse to determine tenant assignment. The ACS finish logic recalculates the tenant from user.email rather than binding token issuance to the validated SAML configuration. An attacker with control over a SAML Identity Provider (IdP) can complete a valid SAML flow for an attacker-controlled domain while asserting an email from another tenant's domain. This causes issuance of a SAML token and tenant-scoped JWT for the wrong tenant, enabling cross-tenant account takeover. The vulnerability is addressed in prowler 5.30.3.
Potential Impact
An authenticated attacker controlling a SAML IdP can exploit this vulnerability to obtain authentication tokens scoped to a tenant they do not belong to, resulting in cross-tenant account takeover. This compromises confidentiality and integrity of tenant data. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and high impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade prowler to version 5.30.3 or later, where this improper authentication vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor stating the fix is in 5.30.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-02T16:50:27.886Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a513aee68715ace43ff0a8a
Added to database: 07/10/2026, 18:33:18 UTC
Last enriched: 07/18/2026, 15:31:06 UTC
Last updated: 08/22/2026, 22:52:15 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.