CVE-2026-59151

Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.30.3

Description The SAML authentication flow trusts the email domain asserted in a SAMLResponse to determine the recipient tenant of the final token. Additionally, the ACS finish logic in the endpoint 'api/src/backend/api/v1/views.py' recalculates the tenant based on the user.email variable instead of binding token issuance to the validated SAML configuration. An authenticated attacker using a controlled SAML Identity Provider (IdP) can complete a valid SAML flow for a domain they control while asserting an email address from a different configured domain. This allows the issuance of a SAMLToken and a tenant-scoped JSON Web Token (JWT)—a compact, URL-safe means of representing claims to be transferred between two parties—for the incorrect tenant, leading to cross-tenant account takeover.

Recommendations Update to version 5.30.3.