CVE-2026-59151

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.

• CWE-287

• https://github.com/prowler-cloud/prowler/commit/bf3b5c2ba713e533014927141b64948c82c8f32ePatch
• https://github.com/prowler-cloud/prowler/commit/f5ff30ad175bd2edf02cd28872653c1cda5867b7Patch
• https://github.com/prowler-cloud/prowler/pull/11650Issue Tracking
• https://github.com/prowler-cloud/prowler/releases/tag/5.30.3Release Notes
• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvpExploit, Vendor Advisory
• https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvpExploit, Vendor Advisory

Published

Jul 10, 2026

Last Modified

Aug 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59145Data::Intern::Shared versions before 0.02 for Perl allow an …9.1
• CVE-2026-59146Data::SpatialHash::Shared versions before 0.02 for Perl allo…7.8
• CVE-2026-59147Data::DisjointSet::Shared versions before 0.02 for Perl allo…9.8
• CVE-2026-59148Mockoon provides way to design and run mock APIs. Prior to 9…8.8
• CVE-2026-59149Mockoon provides way to design and run mock APIs. Prior to 9…6.5
• CVE-2026-5915Insufficient validation of untrusted input in WebML in Googl…8.1
• CVE-2026-59152LangSmith Client SDKs provide SDK's for interacting with the…5
• CVE-2026-59153Anki is a program for creating and reviewing flashcards. Pri…2.1
• CVE-2026-59154Wekan is open source kanban built with Meteor. Prior to 9.64…4.3
• CVE-2026-59155Nezha Monitoring is a self-hostable, lightweight, servers an…6.9
• CVE-2026-59156OpenImageIO is a toolset for reading, writing, and manipulat…6.5
• CVE-2026-59157webhookd is a minimalist webhook server that triggers shell …6.5