GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.

Affected: PyPI: gpustack

### Impact

The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions.

No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment is affected, not only SAML-enabled ones. Anyone who can reach the endpoint over the network can authenticate as an arbitrary identity by posting a response that names it:

- If the name matches an existing user (e.g. an administrator), the attacker receives that user's session — full account takeover, including administrator access. - Otherwise, a new non-admin user is provisioned.

Administrator access grants full control over the deployment and the infrastructure it manages. Because Response/Assertion IDs are never consumed, a captured signed response also replays indefinitely.

Precondition: network reachability to /auth/saml/callback. SAML SSO configuration is not required. A full proof-of-concept is available privately to maintainers.

### Patches

Fixed in gpustack 2.2.2: - The SAML callback now validates the response via OneLogin_Saml2_Auth.process_response() — signature, issuer, audience, destination, and time conditions — and rejects responses that fail, so forged or replayed asser…