CVE-2026-59151: Cross-Tenant Account Takeover via Improper SAML Assertion Validation in Prowler

Vulnerability ID: CVE-2026-59151
CVSS Score: 9.6
Published: 2026-09-11

A critical authentication bypass and cross-tenant account takeover vulnerability exists in the Prowler cloud security platform due to improper validation of the SAML Assertion Consumer Service (ACS) flow. An authenticated attacker controlling a custom Identity Provider (IdP) can forge assertions targeting arbitrary user identities across distinct tenants, allowing complete unauthorized access to target tenant-scoped resources.

TL;DR

An architectural flaw in Prowler's SAML validation allows attackers to bypass tenant isolation and take over arbitrary victim accounts by manipulating the asserted NameID value in their own custom IdP.

Technical Details

• CWE ID: CWE-287
• Attack Vector: Network (AV:N)
• CVSS v3.1: 9.6
• EPSS Score: 0.00322
• Impact: Cross-Tenant Account Takeover
• Exploit Status: None (No active public exploits)
• KEV Status: Not Listed

Affected Systems

• Prowler Cloud Security Platform < 5.30.3
• Prowler API < 1.31.3
• Prowler: < 5.30.3 (Fixed in: 5.30.3)
• Prowler API: < 1.31.3 (Fixed in: 1.31.3)

Code Analysis

Commit: bf3b5c2

Fix SAML cross-tenant account takeover by restricting organization slug validation

Commit: f5ff30a

Improve ACS endpoint tenant routing and add user tenancy check

Mitigation Strategies

• Upgrade Prowler deployment to version 5.30.3 or higher.
• Audit existing SAML configurations to verify all active domains correspond to verified organization entities.
• Monitor application container logs for domain mismatch warnings.

Remediation Steps:

1. Identify the running version of the Prowler API container.
2. Pull the updated Prowler image with tag 5.30.3 or higher, and Prowler API container with tag 1.31.3 or higher.
3. Restart the application services to apply the patched code paths.
4. Execute automated tests of the SAML SSO flow to ensure legitimate organization users can authenticate.

References

• GitHub Security Advisory GHSA-h8m9-jgf8-vwvp
• Prowler Pull Request #11650

Read the full report for CVE-2026-59151 on our website for more details including interactive diagrams and full exploit analysis.