Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
CVE-2026-59151 (GCVE-0-2026-59151)
Vulnerability from cvelistv5 – Published: 2026-07-10 17:50 – Updated: 2026-07-13 18:03
VLAI
EPSS
VEX
Title
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
Summary
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 18:02 UTC
CWE
- CWE-287 - Improper Authentication
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/prowler-cloud/prowler/security… | x_refsource_CONFIRM |
| https://github.com/prowler-cloud/prowler/pull/11650 | x_refsource_MISC |
| https://github.com/prowler-cloud/prowler/commit/b… | x_refsource_MISC |
| https://github.com/prowler-cloud/prowler/commit/f… | x_refsource_MISC |
| https://github.com/prowler-cloud/prowler/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| prowler-cloud | prowler |
Affected:
< 5.30.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59151",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T18:02:53.136588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T18:03:20.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "prowler",
"vendor": "prowler-cloud",
"versions": [
{
"status": "affected",
"version": "\u003c 5.30.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler\u0027s SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:50:07.303Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp"
},
{
"name": "https://github.com/prowler-cloud/prowler/pull/11650",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prowler-cloud/prowler/pull/11650"
},
{
"name": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e"
},
{
"name": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7"
},
{
"name": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3"
}
],
"source": {
"advisory": "GHSA-h8m9-jgf8-vwvp",
"discovery": "UNKNOWN"
},
"title": "Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59151",
"datePublished": "2026-07-10T17:50:07.303Z",
"dateReserved": "2026-07-02T16:50:27.886Z",
"dateUpdated": "2026-07-13T18:03:20.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
PYSEC-2026-3725
Vulnerability from pysec - Published: 2026-07-10 19:17 - Updated: 2026-08-27 23:45
VLAI
Details
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.
Severity
9.6 (Critical)
Impacted products
| Name | purl | prowler-cloud | pkg:pypi/prowler-cloud |
|---|
Aliases
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "prowler-cloud",
"purl": "pkg:pypi/prowler-cloud"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.30.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.0rc1",
"0.0.0rc10",
"0.0.0rc11",
"0.0.0rc2",
"0.0.0rc3",
"0.0.0rc4",
"0.0.0rc5",
"0.0.0rc6",
"0.0.0rc7",
"0.0.0rc8",
"0.0.0rc9",
"3.0.0",
"3.0.0rc1",
"3.0.0rc11",
"3.0.0rc12",
"3.0.0rc13",
"3.0.0rc14",
"3.0.0rc15",
"3.0.1",
"3.0.2",
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4",
"3.10.0",
"3.11.0",
"3.11.1",
"3.11.2",
"3.11.3",
"3.12.0",
"3.12.1",
"3.13.0",
"3.13.1",
"3.14.0",
"3.15.0",
"3.15.1",
"3.15.2",
"3.15.3",
"3.16.0",
"3.16.1",
"3.16.10",
"3.16.11",
"3.16.12",
"3.16.13",
"3.16.14",
"3.16.15",
"3.16.17",
"3.16.2",
"3.16.3",
"3.16.4",
"3.16.5",
"3.16.6",
"3.16.7",
"3.16.8",
"3.16.9",
"3.2.0",
"3.2.1",
"3.2.2",
"3.2.3",
"3.2.4",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.3.4",
"3.4.0",
"3.4.1",
"3.5.0",
"3.5.1",
"3.5.2",
"3.5.3",
"3.6.0",
"3.6.1",
"3.7.0",
"3.7.1",
"3.7.2",
"3.8.0",
"3.8.1",
"3.8.2",
"3.9.0",
"4.0.0",
"4.0.1",
"4.1.0",
"4.2.0",
"4.2.1",
"4.2.2",
"4.2.3",
"4.2.4",
"4.3.0",
"4.3.1",
"4.3.2",
"4.3.3",
"4.3.4",
"4.3.5",
"4.3.6",
"4.3.7",
"4.4.0",
"4.4.1",
"4.5.0",
"4.5.1",
"4.5.2",
"4.5.3",
"4.6.0",
"4.6.1",
"4.6.2",
"5.0.0",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.1.0",
"5.1.1",
"5.1.2",
"5.1.3",
"5.1.4",
"5.1.5",
"5.10.0",
"5.10.1",
"5.10.2",
"5.11.0",
"5.12.0",
"5.12.1",
"5.12.2",
"5.12.3",
"5.13.0",
"5.13.1",
"5.14.0",
"5.14.1",
"5.14.2",
"5.15.0",
"5.15.1",
"5.16.0",
"5.16.1",
"5.17.0",
"5.17.1",
"5.18.0",
"5.18.1",
"5.18.2",
"5.18.3",
"5.19.0",
"5.2.0",
"5.2.1",
"5.2.2",
"5.2.3",
"5.20.0",
"5.21.0",
"5.21.1",
"5.22.0",
"5.23.0",
"5.24.0",
"5.24.1",
"5.24.2",
"5.24.3",
"5.24.4",
"5.25.0",
"5.25.1",
"5.25.2",
"5.25.3",
"5.26.0",
"5.26.1",
"5.27.0",
"5.27.1",
"5.28.0",
"5.28.1",
"5.29.0",
"5.29.1",
"5.29.2",
"5.3.0",
"5.30.0",
"5.30.1",
"5.30.2",
"5.4.0",
"5.4.1",
"5.4.2",
"5.4.3",
"5.4.4",
"5.5.1",
"5.6.0",
"5.7.0",
"5.7.1",
"5.7.2",
"5.7.3",
"5.7.4",
"5.7.5",
"5.8.0",
"5.8.1",
"5.9.0",
"5.9.1",
"5.9.2"
]
}
],
"aliases": [
"CVE-2026-59151",
"GHSA-h8m9-jgf8-vwvp"
],
"details": "Prowler is a cloud security platform. Prior to 5.30.3, Prowler\u0027s SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.",
"id": "PYSEC-2026-3725",
"modified": "2026-08-27T23:45:38.224652Z",
"published": "2026-07-10T19:17:26.780Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/prowler-cloud/prowler/releases/tag/5.30.3"
},
{
"type": "REPORT",
"url": "https://github.com/prowler-cloud/prowler/pull/11650"
},
{
"type": "FIX",
"url": "https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32e"
},
{
"type": "FIX",
"url": "https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7"
},
{
"type": "EVIDENCE",
"url": "https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}