{"id":13499,"date":"2026-09-04T19:00:47","date_gmt":"2026-09-04T11:00:47","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-59151"},"modified":"2026-09-04T19:00:47","modified_gmt":"2026-09-04T11:00:47","slug":"cve-2026-59151","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-59151","title":{"rendered":"CVE-2026-59151 [CRITICAL] &#8211; Prowler is a cloud security platform. Prior to 5.30.3, Prowler&#8217;s SAML authentication flow"},"content":{"rendered":"<p>Prowler is a cloud security platform. Prior to 5.30.3, Prowler&#8217;s SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api\/src\/backend\/api\/v1\/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker with a controlled SAML IdP could complete a valid SAML flow for an attacker-controlled domain while asserting an email address from another configured domain, causing a SAMLToken and tenant-scoped JWT to be issued for the wrong tenant and enabling cross-tenant account takeover. This issue is fixed in version 5.30.3.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Prowler is a cloud security platform. Prior to 5.30.3, Prowler&#8217;s SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token,<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-13499","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/13499","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13499"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13499"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13499"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}