GHSA-h8m9-jgf8-vwvp: Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
HIGHCritical vulnerability — CVSS 9.6
What to do
- Critical severity — schedule an urgent patch.
## SAML Tenant Binding Enables Cross-Tenant Account Takeover ### Summary Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token. A malicious tenant with its own SAML configuration and a self-controlled IdP could complete a valid SAML flow for its own configured domain, while asserting an email address from another configured domain. …
CVE · detail
- CVE-2026-59151nvd ↗EPSS 0.32%
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected