CVE-2026-102894: GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Vulnerability summary

CVE-2026-102894 is a critical (CVSS 9.1) Authentication Bypass by Capture-replay vulnerability in gpustack. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.6% of scored vulnerabilities.

Timeline

1. 04-11-2026
   PublishedVulnerability first disclosed.
2. 06-11-2026
   Last modifiedVulnerability information updated.

Description

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
• CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.