Vulnpedia
← Search CVEs

CVE-2026-100169

HIGH 7.6

Published 2026-10-14 · Last modified 2026-10-16

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.

ELEVATED IMPACT

Severe if exploited (CVSS 7.6), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.9%chance of exploitation in 30 days · 58th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.6CVSS 4.0 · HIGH

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Prowler

Products Prowler

Weakness (CWE)

  • CWE-287: Improper Authentication

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • prowler-cloud PyPI

    pkg:pypi/prowler-cloud

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 5.30.3
    191 explicitly listed affected versions

    0.0.0rc1, 0.0.0rc10, 0.0.0rc11, 0.0.0rc2, 0.0.0rc3, 0.0.0rc4, 0.0.0rc5, 0.0.0rc6, 0.0.0rc7, 0.0.0rc8, 0.0.0rc9, 3.0.0, 3.0.0rc1, 3.0.0rc11, 3.0.0rc12, 3.0.0rc13, 3.0.0rc14, 3.0.0rc15, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.10.0, 3.11.0, 3.11.1, 3.11.2, 3.11.3, 3.12.0, 3.12.1, 3.13.0, 3.13.1, 3.14.0, 3.15.0, 3.15.1, 3.15.2, 3.15.3, 3.16.0, 3.16.1, 3.16.10, 3.16.11, 3.16.12, 3.16.13, 3.16.14, 3.16.15, 3.16.17, 3.16.2, 3.16.3, 3.16.4, 3.16.5, 3.16.6, 3.16.7, 3.16.8, 3.16.9, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.7.2, 3.8.0, 3.8.1, 3.8.2, 3.9.0, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0, 4.6.1, 4.6.2, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.10.0, 5.10.1, 5.10.2, 5.11.0, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.13.0, 5.13.1, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.16.0, 5.16.1, 5.17.0, 5.17.1, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.19.0, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.20.0, 5.21.0, 5.21.1, 5.22.0, 5.23.0, 5.24.0, 5.24.1, 5.24.2, 5.24.3, 5.24.4, 5.25.0, 5.25.1, 5.25.2, 5.25.3, 5.26.0, 5.26.1, 5.27.0, 5.27.1, 5.28.0, 5.28.1, 5.29.0, 5.29.1, 5.29.2, 5.3.0, 5.30.0, 5.30.1, 5.30.2, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.5.1, 5.6.0, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.8.0, 5.8.1, 5.9.0, 5.9.1, 5.9.2

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-h8m9-jgf8-vwvp/GHSA-h8m9-jgf8-vwvp.json"
  }
}
    GitHub Advisory Database · GHSA-h8m9-jgf8-vwvp · Updated 2026-10-15T02:55:47.735531350Z
  • prowler-cloud PyPI

    pkg:pypi/prowler-cloud

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 5.30.3
    191 explicitly listed affected versions

    0.0.0rc1, 0.0.0rc10, 0.0.0rc11, 0.0.0rc2, 0.0.0rc3, 0.0.0rc4, 0.0.0rc5, 0.0.0rc6, 0.0.0rc7, 0.0.0rc8, 0.0.0rc9, 3.0.0, 3.0.0rc1, 3.0.0rc11, 3.0.0rc12, 3.0.0rc13, 3.0.0rc14, 3.0.0rc15, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.10.0, 3.11.0, 3.11.1, 3.11.2, 3.11.3, 3.12.0, 3.12.1, 3.13.0, 3.13.1, 3.14.0, 3.15.0, 3.15.1, 3.15.2, 3.15.3, 3.16.0, 3.16.1, 3.16.10, 3.16.11, 3.16.12, 3.16.13, 3.16.14, 3.16.15, 3.16.17, 3.16.2, 3.16.3, 3.16.4, 3.16.5, 3.16.6, 3.16.7, 3.16.8, 3.16.9, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.7.2, 3.8.0, 3.8.1, 3.8.2, 3.9.0, 4.0.0, 4.0.1, 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.6.0, 4.6.1, 4.6.2, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.10.0, 5.10.1, 5.10.2, 5.11.0, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.13.0, 5.13.1, 5.14.0, 5.14.1, 5.14.2, 5.15.0, 5.15.1, 5.16.0, 5.16.1, 5.17.0, 5.17.1, 5.18.0, 5.18.1, 5.18.2, 5.18.3, 5.19.0, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.20.0, 5.21.0, 5.21.1, 5.22.0, 5.23.0, 5.24.0, 5.24.1, 5.24.2, 5.24.3, 5.24.4, 5.25.0, 5.25.1, 5.25.2, 5.25.3, 5.26.0, 5.26.1, 5.27.0, 5.27.1, 5.28.0, 5.28.1, 5.29.0, 5.29.1, 5.29.2, 5.3.0, 5.30.0, 5.30.1, 5.30.2, 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.5.1, 5.6.0, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.8.0, 5.8.1, 5.9.0, 5.9.1, 5.9.2

    Additional upstream package constraints
    {
  "ecosystem": {},
  "database": {
    "source": "https://github.com/pypa/advisory-database/blob/main/vulns/prowler-cloud/PYSEC-2026-3725.yaml"
  }
}
    PyPA · PYSEC-2026-3725 · Updated 2026-10-15T02:55:47.735531350Z

All CVSS metrics

  • HIGH 7.6 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • HIGH 7.6 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS