GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Impact

The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions.

No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment is affected, not only SAML-enabled ones. Anyone who can reach the endpoint over the network can authenticate as an arbitrary identity by posting a response that names it:

• If the name matches an existing user (e.g. an administrator), the attacker receives that user's session — full account takeover, including administrator access.
• Otherwise, a new non-admin user is provisioned.

Administrator access grants full control over the deployment and the infrastructure it manages. Because Response/Assertion IDs are never consumed, a captured signed response also replays indefinitely.

Precondition: network reachability to /auth/saml/callback. SAML SSO configuration is not required. A full proof-of-concept is available privately to maintainers.

Patches

Fixed in gpustack 2.2.2:

• The SAML callback now validates the response via OneLogin_Saml2_Auth.process_response() — signature, issuer, audience, destination, and time conditions — and rejects responses that fail, so forged or replayed assertions are no longer accepted.
• The SAML and OIDC login/callback routes are now gated to run only when that provider is the configured active provider, so a deployment that has not enabled the provider no longer parses attacker-supplied IdP payloads.

Workarounds

There is no effective configuration-level workaround — disabling or not configuring SAML does not mitigate this on affected versions, since the callback runs regardless. Until upgraded, block network access to /auth/saml/callback (e.g. at a reverse proxy / ingress).

Credit

Reported privately by Austin Chu, Sohee Kim, and Corban Villa (UC Berkeley security research project), and independently, earlier, by a researcher who wishes to remain anonymous.