GPUStack SAML Callback Flaw Allows Full Authentication Bypass and Admin Takeover (CVE-2026-102894)

A critical vulnerability disclosed via GitHub Security Advisory GHSA-62m9-f875-rqw6 (CVE-2026-102894, CVSS 9.1) affects gpustack, a pip-distributed package. According to the advisory, the /auth/saml/callback endpoint Base64-decodes a posted SAML response, reads the NameID and attributes, resolves or provisions a user, and mints a gpustack_session JWT. It never calls OneLogin_Saml2_Auth.process_response(), the function that verifies the signature, issuer, audience, destination, and time conditions.

Why It Matters

The advisory states this affects every deployment, not just those with SAML SSO configured. The callback processes attacker-supplied payloads and issues sessions regardless. No credentials are required. An attacker who can reach the endpoint can post a crafted response naming any identity. If it matches an existing user, including an administrator, they receive that user's full session and privileges. If not, a new non-admin account is provisioned. The advisory also notes that because Response and Assertion IDs are never consumed, a captured signed response can be replayed indefinitely. Administrator access yields full control over the deployment and its underlying infrastructure. This is a complete authentication bypass. A full proof-of-concept exists but, per the advisory, is available only privately to maintainers.

What Defenders Should Do Now

• Identify any gpustack instances in your environment and determine their network exposure, particularly to /auth/saml/callback.
• Upgrade to gpustack 2.2.2 or later, where the callback validates responses via process_response() and the SAML and OIDC routes only run when that provider is the configured active provider.
• Per the advisory, there is no effective configuration-level workaround. Disabling or not configuring SAML does not help, since the callback runs regardless. Until patched, block network access to /auth/saml/callback at a reverse proxy or ingress.
• Hunt for anomalous POSTs to the SAML callback path and unexpected new-user provisioning events or administrator session creation with no corresponding legitimate SSO login flow.
• Review authentication logs for sessions tied to users who do not use SAML, which would be a strong indicator of exploitation.

This is developing intel based on a same-day advisory. Details on exploitation in the wild are not yet established. For full technical details and the patch, see the original advisory: GHSA-62m9-f875-rqw6.