The vulnerability arises from improper authentication in Prowler’s social account linking, allowing an unauthenticated attacker to associate a Google or GitHub login with any local account that shares the same email address without verifying ownership. This grants the attacker persistent access to the victim’s account, including cloud provider credentials, scan findings, and tenant memberships. The flaw is a classic CWE‑287 improper authentication issue, leading to remote account takeover.

Affected vendor is Prowler, product Prowler. Any installation running version 5.4.0 up to but not including 5.35.0 is vulnerable. Versions before 5.4.0 are unaffected, and 5.35.0 and newer incorporate the fix.

The CVSS score of 7.6 indicates high severity, and the EPSS score of <1% suggests a very low probability of exploitation, although it is not zero. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to register an email address that matches a future victim’s address or identify an existing local account with that email, then use the social login path to link it, bypassing verification. Once linked, the attacker can log in and gain full account capabilities. Given the remote nature and lack of prerequisites beyond access to the social provider, the risk remains significant for environments where self‑registration is enabled without email verification.