Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-62m9-f875-rqw6
gpustackImpact
The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions.
No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment is affected, not only SAML-enabled ones. Anyone who can reach the endpoint over the network can authenticate as an arbitrary identity by posting a response that names it:
- If the name matches an existing user (e.g. an administrator), the attacker receives that user's session — full account takeover, including administrator access.
- Otherwise, a new non-admin user is provisioned.
Administrator access grants full control over the deployment and the infrastructure it manages. Because Response/Assertion IDs are never consumed, a captured signed response also replays indefinitely.
Precondition: network reachability to /auth/saml/callback. SAML SSO configuration is not required. A full proof-of-concept is available privately to maintainers.
Patches
Fixed in gpustack 2.2.2:
- The SAML callback now validates the response via OneLogin_Saml2_Auth.process_response() — signature, issuer, audience, destination, and time conditions — and rejects responses that fail, so forged or replayed assertions are no longer accepted.
- The SAML and OIDC login/callback routes are now gated to run only when that provider is the configured active provider, so a deployment that has not enabled the provider no longer parses attacker-supplied IdP payloads.
Workarounds
There is no effective configuration-level workaround — disabling or not configuring SAML does not mitigate this on affected versions, since the callback runs regardless. Until upgraded, block network access to /auth/saml/callback (e.g. at a reverse proxy / ingress).
Credit
Reported privately by Austin Chu, Sohee Kim, and Corban Villa (UC Berkeley security research project), and independently, earlier, by a researcher who wishes to remain anonymous.
Upload your own SBOM in CycloneDX 1.6 or higher (JSON) directly here to check your vulnerabilities.
Drag and drop some file here, or click to select
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard