CVE-2026-102894 - GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
CVE ID :CVE-2026-102894 Published : Nov. 4, 2026, 10:17 p.m. | 48 minutes ago Description :GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and...