Prowler’s SAML authentication flow improperly trusted the email domain inside the SAMLResponse when determining the tenant for the issued token. The ACS finish logic recalculated the tenant from the user’s email instead of binding the token issuance to the validated SAML configuration, allowing an authenticated attacker who controls a SAML Identity Provider to supply a victim’s email from one tenant while using a domain tied to another. This flaw can grant the attacker a tenant‑scoped JWT that provides access to resources in an unauthorized tenant, resulting in a cross‑tenant account takeover.

The vulnerability affects the Prowler Cloud platform before version 5.30.3, specifically the prowler-cloud prowler product. Any deployment running a release earlier than 5.30.3 is vulnerable.

The CVSS score of 9.6 indicates a critical severity. The EPSS score of <1 % reflects a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attack requires control over a SAML IdP or compromise of an existing IdP. An attacker can forge a valid SAML response, forcing Prowler to issue a token for the wrong tenant, a fully remote attack with no local privilege escalation needed.