Improper Authentication in Prowler API allows unauthorized account access

CVE-2026-100169

What is CVE-2026-100169?

An improper authentication vulnerability exists in the Prowler API, affecting versions prior to 5.35.0. This flaw permits remote unauthenticated attackers to link their accounts with the accounts of users who have not yet registered. Specifically, the mechanism fails to verify the ownership of emails before linking, allowing attackers to register with a valid email address and gain unauthorized access to accounts associated with that address. The lack of verification means that attackers effectively hijack accounts when the legitimate users attempt to log in via social providers like Google or GitHub. The security measures in place fail to prevent the exploitation of this vulnerability, as self-registration is open, and user account permissions are improperly configured. Consequently, sensitive data held in the compromised accounts may be accessed by malicious actors.

References