Prowler’s SAML authentication flow incorrectly trusted the email domain included in a SAMLResponse when determining the tenant for which a token should be issued, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration, allowing an attacker who controls a SAML Identity Provider (IdP) to supply a victim’s email from one tenant while using a domain tied to another, resulting in a SAML token and tenant‑scoped JWT that grants access to the wrong tenant’s resources. This flaw enables an account takeover that bypasses normal tenant isolation boundaries. This flaw is a CWE‑287 Authentication Bypass Through Spoofed Credentials type weakness.

The vulnerability affects Prowler Cloud platform versions earlier than 5.30.3, specifically the prowler cloud product. Only and have not applied the 5.30.3 update are impacted.

The CVSS score of 9.6 indicates a critical severity. The EPSS score of <1% reflects a very low current exploitation probability, and the lack of early listings in KEV suggests the exploit is not yet widely observed. The attack requires an attacker who can control a SAML Identity Provider (IdP) or compromise one they already have access to; with this control, the attacker can forge a valid SAML response, leading to immediate cross‑tenant token issuance. The flaw is fully remote with no local privilege escalation required.