CVE-2026-100169: Prowler 5.4.0 to before 5.35.0

Affected technology

Prowler · 5.4.0 to before 5.35.0
Prowler

Description’s affected range: before 5.35.0

Component: Prowler API
File: api/src/backend/api/adapters.py, api/src/backend/config/settings/social_login.py, api/src/backend/api/v1/views.py

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

A remote unauthenticated attacker can obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Source advisory’s CVSS 4.0 assessment (base score 7.6/10) rates confidentiality and integrity impact as high; availability impact as none.