Prowler CVE-2026-100169

Exploitation requires the Prowler API to be deployed with social login (Google or GitHub) enabled and the vulnerable settings in config/settings/social_login.py active: SOCIALACCOUNT_EMAIL_AUTHENTICATION=True and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT=True, ACCOUNT_EMAIL_VERIFICATION=none, and the AllowAny create permission on UserViewSet. The decisive precondition is a race: the attacker must self-register the victim's exact email address BEFORE the victim has registered or linked SSO (the flaw is account PRE-hijacking of an unregistered user). Limiting factors that reduce realistic risk: the attacker must know and target a specific victim email, the victim must subsequently authenticate via the social provider (passive user interaction), and the window closes once the legitimate owner has already created or linked an account. Affects versions 5.4.0 up to but not including 5.35.0.

The source assigns CVSS 4.0 7.6 (HIGH) with vector AV:N/AC:L/AT:P/PR:N/UI:P, and the signals are internally consistent: PR:N reflects that self-registration is genuinely open (UserViewSet.get_permissions() grants AllowAny to create, ACCOUNT_EMAIL_VERIFICATION=none), so an attacker needs no prior credentials. However, two metrics heavily constrain real-world impact: AT:P encodes a timing/precondition requirement (the attacker must register the victim's email BEFORE the victim ever registers), and UI:P requires the victim to later authenticate via Google or GitHub. Together these make this a targeted pre-account-hijacking flaw rather than a mass-exploitable one - you must know and race a specific victim's email, then wait for them to sign in via SSO. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or automatable exploitation; the only 'source code' supplied is the vendor's remediation commit, not an attack POC. VC:H/VI:H (high confidentiality and integrity impact) is justified because a successful takeover yields cloud-provider credentials, scan findings, and tenant memberships. Net: a real and credible vulnerability warranting prompt patching for anyone running Prowler's self-hosted API with Google/GitHub social login, but its targeted, race-and-wait nature places it below indiscriminate internet-wide threats. Note the input is missing EPSS, KEV, and POC signals - treat the 'no active exploitation' conclusion as inferred from absence, not vendor-confirmed.

An attacker who learns a target's email address (e.g. a corporate address of someone expected to onboard to Prowler) self-registers that email and a password on the open registration endpoint before the real owner signs up. When the legitimate owner later logs in with Google or GitHub, django-allauth silently links the SSO identity to the attacker's pre-existing local account without verifying email ownership, so the victim is logged into the attacker's account while the attacker retains their known password. No public exploit code was identified; the only published code is the vendor fix.