CVE-2026-100169

Deferred Deferred - Pending Action

Improper Authentication in Prowler API

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Secur0

Description

Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100169

EUVD

EUVD-2026-101295

Affected Vendors & Products

Vendor	Product	Version / Range
Prowler	Prowler	5.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is an improper authentication vulnerability in Prowler versions 5.4.0 through 5.34.0 that allows account pre-hijacking. An unauthenticated attacker can exploit it by registering a victim's email address first, then taking over the account when the victim logs in via Google or GitHub. The issue occurs because the system links social logins to existing accounts based solely on matching email addresses without verification.

Detection Guidance

Check Prowler version to confirm if it is between 5.4.0 and 5.34.0. Run: prowler version. Inspect social account linking logs for unverified email matches in api/src/backend/api/adapters.py and api/src/backend/api/v1/views.py.

Impact Analysis

An attacker who exploits this can gain full control over your Prowler account, including access to cloud provider credentials, scan findings, and tenant memberships. If you haven't registered yet, the attacker can register your email first and then take over your account when you log in via a social provider.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's principles of data protection and user consent, and HIPAA's requirements for safeguarding protected health information. Unverified account linking may expose personal data, scan findings, or tenant memberships to attackers, risking non-compliance with these regulations.

Mitigation Strategies

Upgrade Prowler to version 5.35.0 or later. Ensure email verification is enabled in social_login.py by setting ACCOUNT_EMAIL_VERIFICATION to mandatory. Disable automatic social account linking by setting SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT to False.

Hi! I’m here to help you understand CVE-2026-100169. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70