CVE-2026-59151 Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
An attacker with a controlled SAML IdP can claim another tenant's domain to obtain valid tokens and achieve cross-tenant account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59151?
CVE-2026-59151 is a critical authentication bypass vulnerability in prowler-cloud prowler, published on 10 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.
Weakness: CWE-287
Which versions are affected by CVE-2026-59151?
It affects 1 product.
Products include Prowler Prowler.
How do I fix CVE-2026-59151?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59151 exists.