CVE-2026-102894

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

gpustack

### Impact The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions. No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every…

10. Nov 2026

Ausgewertete Quellen

• GitHub
  GHSA-62m9-f875-rqw6