CVE-2026-102894

GPUStack, an open-source GPU cluster manager, is vulnerable to an authentication bypass and account takeover in versions 0.7.1 through 2.2.2. The /auth/saml/callback endpoint fails to call OneLogin_Saml2_Auth.process_response, resulting in the processing of unverified SAML XML. Attackers can subm...