CVE-2026-45720

Name of the Vulnerable Software and Affected Versions Omni (affected versions not specified)

Description A TOCTOU (Time-of-Check to Time-of-Use) race condition exists in the SAML.getSession function within internal/pkg/auth/interceptor/saml.go. The system checks the Used flag of a SAMLAssertion resource and subsequently marks it as used in two separate operations. Since these actions are not atomic, concurrent requests using the same saml-session token may both pass validation. This allows an attacker who has intercepted a valid saml-session token to authenticate as the token owner multiple times, bypassing the one-time-use guarantee. This can lead to session replay, the confirmation of multiple attacker-controlled public keys via the ConfirmPublicKey function to establish persistent access, and unauthorized access to gRPC endpoints gated by the SAML interceptor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.